Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,729 results · page 73 of 815
Sep 2, 2026Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.CVE-2026-84760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.CVE-2026-84759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Classified Listing: Missing AuthorizationCVE-2026-84217 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3.
- Product
- Classified Listing
- Affected
- up to 6.1.3
- What to do
- Affects up to 6.1.3. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-83562 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-82223 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.CVE-2026-81775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026WooCommerce Product Attachment: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-81774 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attachment: from n/a through 2.3.4.
- Product
- WooCommerce Product Attachment
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update WooCommerce Product Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.CVE-2026-81772 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.
- Affected
- up to 3.0.31
- What to do
- Affects up to 3.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.CVE-2026-81771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.CVE-2026-81770 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.
- Affected
- up to 1.6.30
- What to do
- Affects up to 1.6.30. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Booking Hub: Incorrect Privilege AssignmentCVE-2026-81769 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1.
- Product
- Booking Hub
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Booking Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.CVE-2026-81294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.CVE-2026-81289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.
- Affected
- up to 5.13.1
- What to do
- Affects up to 5.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.CVE-2026-81288 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.CVE-2026-81286 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.CVE-2026-81283 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
- Affected
- up to 4.3.10
- What to do
- Affects up to 4.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Grand Tour: Cross-Site Request Forgery (CSRF)CVE-2026-66652 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.
- Product
- Grand Tour
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update Grand Tour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Broken Link Checker: Stored Cross-Site ScriptingCVE-2026-75528 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.
- Product
- Broken Link Checker
- Affected
- up to 2.4.13
- What to do
- Affects up to 2.4.13. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 2, 2026Easy Waveform Player: Stored Cross-Site ScriptingCVE-2025-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Waveform Player
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Easy Waveform Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 2, 2026Login With Ajax: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-82883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.
- Product
- Login With Ajax
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Login With Ajax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Divi: Stored Cross-Site ScriptingCVE-2026-3850 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6. This is due to the `redirect_url` attribute being sanitized with `esc_attr()` instead of `esc_url()` before being rendered into the `data-redirect_url` HTML data attribute. Additionally, `redirect_url` is absent from the hardcoded `$url_options` array in `class-et-builder-element.php`, so it does not receive `esc_url_raw()` sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to `window.location.href`, executing arbitrary JavaScript from a `javascript:` URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.
- Product
- Divi
- Affected
- up to 4.27.6
- What to do
- Affects up to 4.27.6. Update Divi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddivichangelog.comwordfence.com
Sep 2, 2026OAuth Single Sign On: Does not verify the identity assertion returned by its Steam single sign-on flowCVE-2026-82183 · WordPress plugins & themes · reported by WPScanHigh 8.1
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
- Product
- OAuth Single Sign On
- Fixed in
- 7.0.1
- What to do
- Update OAuth Single Sign On to 7.0.1 or newer.
Sep 2, 2026WPvivid — Backup, Migration & Staging: Does not sanitise a user supplied list of identifiers before using it in a SQL queryCVE-2026-82182 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.133
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.133 or newer.
Sep 2, 2026Simple Ajax Chat: Does not escape chat message content before rendering itCVE-2026-81807 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
- Product
- Simple Ajax Chat
- Fixed in
- 20260827
- What to do
- Update Simple Ajax Chat to 20260827 or newer.
Sep 2, 2026FAQ Builder AYS: Does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area pageCVE-2026-81737 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.
- Product
- FAQ Builder AYS
- Fixed in
- 1.8.5
- What to do
- Update FAQ Builder AYS to 1.8.5 or newer.
Sep 2, 2026My Login: Does not enforce the network's registration settingCVE-2026-81583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
- Product
- My Login
- Fixed in
- 7.2.0
- What to do
- Update My Login to 7.2.0 or newer.
Sep 2, 2026JetStyleManager for Gutenberg: Does not have CSRF protection on some of its AJAX actionsCVE-2026-81432 · WordPress plugins & themes · reported by WPScanMedium 4.3
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
- Product
- JetStyleManager for Gutenberg
- Fixed in
- 1.3.9
- What to do
- Update JetStyleManager for Gutenberg to 1.3.9 or newer.
Sep 2, 2026WC Vendors: Does not verify ownership or the object type of user-supplied IDsCVE-2026-81428 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
- Product
- WC Vendors
- Fixed in
- 2.7.2.1
- What to do
- Update WC Vendors to 2.7.2.1 or newer.
Sep 2, 2026WC Vendors: Does not verify that the vendor submitting a front-end order shipment status change owns the referenced orderCVE-2026-81427 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
- Product
- WC Vendors
- Fixed in
- 2.7.2.1
- What to do
- Update WC Vendors to 2.7.2.1 or newer.
Sep 2, 2026WC Vendors: Does not have CSRF protection on some of its front-end order shipment status actionsCVE-2026-81426 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
- Product
- WC Vendors
- Fixed in
- 2.7.2.1
- What to do
- Update WC Vendors to 2.7.2.1 or newer.
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning a student's learning statisticsCVE-2026-81199 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning per-student course enrollment and progress dataCVE-2026-81195 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.46
- What to do
- Update MasterStudy LMS to 3.7.46 or newer.
Sep 2, 2026Advanced Custom Fields: Extended: Does not restrict the role submitted through its front-end user forms to the roles the form actually offersCVE-2026-80467 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Sep 2, 2026CatalogX: Does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administratorCVE-2026-79621 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
- Product
- CatalogX
- Fixed in
- 6.1.3
- What to do
- Update CatalogX to 6.1.3 or newer.
Sep 2, 2026SigmaForms Pro – AI Generated Forms: Arbitrary file deletionCVE-2026-78657 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
- Product
- SigmaForms Pro – AI Generated Forms
- Affected
- up to 1.4.11
- What to do
- Affects up to 1.4.11. Update SigmaForms Pro – AI Generated Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfeedback.bdthemes.comwordfence.com
Sep 2, 2026FormLayer: Does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handlerCVE-2026-78151 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
- Product
- FormLayer
- Fixed in
- 1.0.9
- What to do
- Update FormLayer to 1.0.9 or newer.
Sep 2, 2026RegistrationMagic: Does not escape a registration form field value before outputting it in an HTML attribute on an administrative pageCVE-2026-77792 · WordPress plugins & themes · reported by WPScanHigh 7.5
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026Rank Math SEO: Does not verify that the metadata row being updated belongs to the object the user was authorised againstCVE-2026-77788 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026Rank Math SEO: Does not perform a capability checkCVE-2026-77787 · WordPress plugins & themes · reported by WPScanLow 2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026Rank Math SEO: Does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadataCVE-2026-77785 · WordPress plugins & themes · reported by WPScanLow 2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026Rank Math SEO: Does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadataCVE-2026-77784 · WordPress plugins & themes · reported by WPScanLow 2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026Rank Math SEO: Does not verify that the post whose schema it renders on the front end is publicly viewableCVE-2026-77783 · WordPress plugins & themes · reported by WPScanLow 3.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026Rank Math SEO: Does not check whether a post is password protected before using its content to build publicly generated SEO metadataCVE-2026-77782 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277.1
- What to do
- Update Rank Math SEO to 1.0.277.1 or newer.
Sep 2, 2026GamiPress: Does not properly restrict its video watch-tracking functionalityCVE-2026-77764 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
- Product
- GamiPress
- Fixed in
- 7.9.9.6
- What to do
- Update GamiPress to 7.9.9.6 or newer.
Sep 2, 2026MultiVendorX: Does not have proper authorisation controls on one of its REST API listing routesCVE-2026-74927 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications.
- Product
- MultiVendorX
- Fixed in
- 5.0.15
- What to do
- Update MultiVendorX to 5.0.15 or newer.
Sep 2, 2026Social Media Share Buttons & Social Sharing Icons: Does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handlerCVE-2026-19723 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 3.0.1
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 3.0.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.