Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

6,676 results · page 8 of 134

Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization checks before exporting stored form submissionsCVE-2026-105990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
Product
Accept PayPal Payments using Contact Form 7
Fixed in
4.0.7
What to do
Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Accept PayPal Payments using Contact Form 7: Does not perform any authorization or request-validation checks on one of its AJAX actionsCVE-2026-105989 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
Product
Accept PayPal Payments using Contact Form 7
Fixed in
4.0.7
What to do
Update Accept PayPal Payments using Contact Form 7 to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-104762 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, which is not the default configuration.
Product
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Rank Math SEO: Does not escape a stored redirection source value before outputting it in an administrative list viewCVE-2026-104754 · WordPress plugins & themes · reported by WPScanLow 3.5
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
Product
Rank Math SEO
Fixed in
1.0.280
What to do
Update Rank Math SEO to 1.0.280 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Filter Everything — WordPress & WooCommerce Filters: Reflected Cross-Site ScriptingCVE-2026-87869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters from $_SERVER['REQUEST_URI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parse_str() and re-assembles them using build_query() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via preg_replace() without esc_attr() or esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Product
Filter Everything — WordPress & WooCommerce Filters
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update Filter Everything — WordPress & WooCommerce Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment: Generic SQL InjectionCVE-2026-104724 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.
Product
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment
Affected
up to 3.1.13
What to do
Affects up to 3.1.13. Update FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 20263D Product configurator for WooCommerce: Remote Code ExecutionCVE-2026-103889 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
Product
3D Product configurator for WooCommerce
Affected
up to 2.16.2
What to do
Affects up to 2.16.2. Update 3D Product configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Online Scheduling and Appointment Booking System – Bookly: Insecure Direct Object ReferenceCVE-2026-104898 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 28.4
What to do
Affects up to 28.4. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Advanced Form Integration — Connect Forms to 300+ Apps: Authentication BypassCVE-2026-104797 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an attacker-controlled field key and value directly to `UM()->user()->update_profile()` in the `account` context — which explicitly bypasses Ultimate Member's banned-key validation — without performing any submitter identity verification, ownership check, capability check, current-password reauthentication, or restriction on sensitive keys such as `user_pass`. This makes it possible for unauthenticated attackers to change the password of any WordPress user account, including Administrator accounts, by submitting a public Contact Form 7 form with a target email and `user_pass` as the field key, enabling full site takeover. Exploitation requires an administrator to have pre-configured a Contact Form 7 integration that maps the target email, field key, and value from public form inputs to the Ultim
Product
Advanced Form Integration — Connect Forms to 300+ Apps
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Advanced Form Integration — Connect Forms to 300+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Advanced IP Blocker: Authentication BypassCVE-2026-104732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the
Product
Advanced IP Blocker
Affected
up to 8.13.13
What to do
Affects up to 8.13.13. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Advanced Classifieds & Directory Pro: Stored Cross-Site ScriptingCVE-2026-93883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on sites where the 'Force Bootstrap' miscellaneous setting (acadp_misc_settings['force_bootstrap']) is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.
Product
Advanced Classifieds & Directory Pro
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: Authorization bypassCVE-2026-104915 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.
Product
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning: Privilege EscalationCVE-2026-104022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the `add_child()` function calling `add_role('academy_student')` on any existing account resolved from the attacker-supplied `email` parameter before `Store::link()` validates the guardian-ward relationship, and failing to roll back that role write when `Store::link()` returns a `WP_Error`. This makes it possible for authenticated attackers with the `academy_guardian` role or higher to elevate any existing WordPress account — including their own — to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities not granted to the guardian role. When a guardian supplies their own email address, `email_exists()` resolves to their own user ID, causing `Store::link()` to reject the self-link, but because the `add_role()` call has already executed and is never reversed, the academy_student role grant on their own account persists permanently.
Product
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2026Education Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94063 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
Product
Education Center
Affected
up to 3.6.12
What to do
Affects up to 3.6.12. Update Education Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Product Configurator for WooCommerce: Deserialization of Untrusted DataCVE-2026-105872 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
Product
Product Configurator for WooCommerce
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update Product Configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Restrict User Access – Membership Plugin with Force: Missing AuthorizationCVE-2026-62040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
Product
Restrict User Access – Membership Plugin with Force
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96761 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.
Product
Welcart e-Commerce
Affected
up to 2.12.3
What to do
Affects up to 2.12.3. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Search in Place: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
Product
Search in Place
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Search in Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.
Product
ShopBuilder – Elementor WooCommerce Builder Addons
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Deposits and Partial Payments for WooCommerce: Missing AuthorizationCVE-2026-95589 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.
Product
Deposits and Partial Payments for WooCommerce
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Deposits and Partial Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026Pay with Vipps for WooCommerce: Deserialization of Untrusted DataCVE-2026-94568 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
Product
Pay with Vipps for WooCommerce
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Pay with Vipps for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 9, 2026UnitechPay: Does not verify the authenticity of the payment notifications it receivesCVE-2026-87841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
Product
UnitechPay
Affected
up to 1.0.6.3
What to do
Affects up to 1.0.6.3. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 9, 2026SKU Error Fixer for WooCommerce: Does not perform any capability or nonce checks on two of its AJAX actionsCVE-2026-86850 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
Product
SKU Error Fixer for WooCommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update SKU Error Fixer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 9, 2026Ocean Pro Demos and Ocean eComm Treasure Box: Stored Cross-Site ScriptingCVE-2026-81929 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
Product
Ocean Pro Demos and Ocean eComm Treasure Box
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Ocean Pro Demos and Ocean eComm Treasure Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.oceanwp.org docs.oceanwp.org
Oct 8, 2026Tutor LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42698 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
Product
Tutor LMS
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
Product
Gutenberg Blocks by Kadence Blocks
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026YITH WooCommerce Product Bundles: Missing AuthorizationCVE-2026-105878 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
Product
YITH WooCommerce Product Bundles
Affected
up to 2.29.0
What to do
Affects up to 2.29.0. Update YITH WooCommerce Product Bundles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 8, 2026Wallet System for WooCommerce: Does not validate that a wallet transfer amount is positiveCVE-2026-93509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Track Orders for WooCommerce: Does not verify ownership of an order before returning its billing detailsCVE-2026-94275 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
Product
Track Orders for WooCommerce
Fixed in
1.2.7
What to do
Update Track Orders for WooCommerce to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the wallet account named in a withdrawal submission belongs to the user making itCVE-2026-94246 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not verify that the user submitting a wallet transfer owns the wallet being debitedCVE-2026-94245 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Wallet System for WooCommerce: Does not perform any capability checkCVE-2026-94244 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
Product
Wallet System for WooCommerce
Fixed in
2.8.0
What to do
Update Wallet System for WooCommerce to 2.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026BackWPup: Does not properly restrict web access to the working directory it uses during backup restoresCVE-2026-86826 · WordPress plugins & themes · reported by WPScanMedium 5.9
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
Product
BackWPup
Fixed in
5.7.7
What to do
Update BackWPup to 5.7.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Database Addon For WPForms ( wpforms entries ): Does not verify the CSRF nonceCVE-2026-105260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.
Product
Database Addon For WPForms ( wpforms entries )
Fixed in
1.1.1
What to do
Update Database Addon For WPForms ( wpforms entries ) to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Appointment Booking: Does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summaryCVE-2026-105198 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
Product
Appointment Booking
Fixed in
5.7.3
What to do
Update Appointment Booking to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · WordPress plugins & themes · reported by WPScanLow 3.3
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
Product
Appointment Booking
Fixed in
5.6.9
What to do
Update Appointment Booking to 5.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Booking Calendar: Does not generate its per-booking access hashes with sufficient entropyCVE-2026-105193 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
Product
Booking Calendar
Fixed in
11.8
What to do
Update Booking Calendar to 11.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Frontend Dashboard: Does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request dataCVE-2026-103692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.
Product
Frontend Dashboard
Fixed in
3.0.5
What to do
Update Frontend Dashboard to 3.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026LatePoint - Appointment Booking & Reservation: Insecure Direct Object ReferenceCVE-2026-17538 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.
Product
LatePoint - Appointment Booking & Reservation
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update LatePoint - Appointment Booking & Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 7, 2026WP Data Access: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-95605 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.
Product
WP Data Access
Affected
up to 5.5.82
What to do
Affects up to 5.5.82. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Pix por Piggly (para Woocommerce): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42714 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
Product
Pix por Piggly (para Woocommerce)
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Pix por Piggly (para Woocommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026WPCafe: Does not restrict access to some of its REST API endpointsCVE-2026-86816 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
Product
WPCafe
Fixed in
3.0.21
What to do
Update WPCafe to 3.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026WP Coder: Does not restrict access to its PHP code-execution feature to administratorsCVE-2026-104677 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
Product
WP Coder
Fixed in
4.5.2
What to do
Update WP Coder to 4.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Yaad Sarig Payment Gateway For WC: Does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actionsCVE-2026-104651 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.
Product
Yaad Sarig Payment Gateway For WC
Fixed in
2.2.13
What to do
Update Yaad Sarig Payment Gateway For WC to 2.2.13 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Academy LMS: Does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer optionsCVE-2026-104050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.
Product
Academy LMS
Fixed in
4.0.0
What to do
Update Academy LMS to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Geliver Akıllı Kargo Pazaryeri: Does not prevent unauthenticated access to a log file it stores within its own web-accessible directoryCVE-2026-103378 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
Product
Geliver Akıllı Kargo Pazaryeri
Fixed in
3.1.1
What to do
Update Geliver Akıllı Kargo Pazaryeri to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Integration for Epos Now and WooCommerce: Does not perform an authorization check on one of its REST endpointsCVE-2026-103323 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
Product
Integration for Epos Now and WooCommerce
Fixed in
4.11.2
What to do
Update Integration for Epos Now and WooCommerce to 4.11.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 6, 2026Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.CVE-2026-95526 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.CVE-2026-62072 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.CVE-2026-48199 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.