Vulnerability database

9,229 results · page 8 of 185

• Oct 5, 2026Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104396 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2.

  Product

  Name Directory

  Affected

  up to 1.34.2

  What to do

  Affects up to 1.34.2. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Sirv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-104389 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.

  Product

  Sirv

  Affected

  up to 8.2.5

  What to do

  Affects up to 8.2.5. Update Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Taxi Booking Manager for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-103351 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

  Product

  Taxi Booking Manager for WooCommerce

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Premium Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109.

  Product

  Premium Addons for Elementor

  Affected

  up to 4.11.109

  What to do

  Affects up to 4.11.109. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Presto Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102914 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.

  Product

  Presto Player

  Affected

  up to 4.5.2

  What to do

  Affects up to 4.5.2. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Starter Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102393 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.

  Product

  Starter Templates

  Affected

  up to 4.7.7

  What to do

  Affects up to 4.7.7. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97276 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

  Product

  WP Statistics

  Affected

  up to 14.16.14

  What to do

  Affects up to 14.16.14. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103355 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.

  Product

  Gutenberg Blocks by Kadence Blocks

  Affected

  up to 3.7.11.1

  What to do

  Affects up to 3.7.11.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026TranslatePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103062 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

  Product

  TranslatePress

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 4, 2026Simple Shopping Cart: Does not escape some of its settings field values before outputting them on an admin settings pageCVE-2026-104119 · WordPress plugins & themes · reported by WPScanLow 3.5

  The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.

  Product

  Simple Shopping Cart

  Fixed in

  5.2.6

  What to do

  Update Simple Shopping Cart to 5.2.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 3, 2026Kirki: Improper Validation of Specified Quantity in InputCVE-2026-103065 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

  Product

  Kirki

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 3, 2026Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication leading to Account PersistenceCVE-2026-97343 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have o

  Product

  Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 3, 2026Simple Membership: Unauthorized modification of data and sensitive information disclosureCVE-2026-97337 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the member's username and plaintext password — to an attacker-chosen address, and to then activate that member's account without their consent.

  Product

  Simple Membership

  Affected

  up to 4.8.3

  What to do

  Affects up to 4.8.3. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 3, 2026Mailchimp for WooCommerce: Does not require authenticationCVE-2026-92437 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.

  Product

  Mailchimp for WooCommerce

  Fixed in

  6.3

  What to do

  Update Mailchimp for WooCommerce to 6.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026WP Ultimate CSV Importer: Does not use a site-specific secretCVE-2026-80518 · WordPress plugins & themes · reported by WPScanLow 3.7

  The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.

  Product

  WP Ultimate CSV Importer

  Fixed in

  9.2

  What to do

  Update WP Ultimate CSV Importer to 9.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 3, 2026WP Ultimate CSV Importer: Does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served locationCVE-2026-80517 · WordPress plugins & themes · reported by WPScanLow 3.5

  The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.

  Product

  WP Ultimate CSV Importer

  Fixed in

  9.2

  What to do

  Update WP Ultimate CSV Importer to 9.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 2, 2026Booking Calendar: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-39601 · WordPress plugins & themes · reported by PatchstackLow 3.7

  Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

  Product

  Booking Calendar

  Affected

  up to 11.8.4

  What to do

  Affects up to 11.8.4. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 2, 2026Smart One Click Setup – Complete Demo Import & Export: Insertion of Sensitive Information Into Sent DataCVE-2026-32584 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3.

  Product

  Smart One Click Setup – Complete Demo Import & Export

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Smart One Click Setup – Complete Demo Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 2, 2026ThemeREX Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

  Product

  ThemeREX Addons

  Affected

  up to 2.46.0

  What to do

  Affects up to 2.46.0. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 2, 2026WP Statistics – Simple, privacy-friendly Google Analytics alternative: Reflected Cross-Site ScriptingCVE-2026-97652 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  WP Statistics – Simple, privacy-friendly Google Analytics alternative

  Affected

  up to 14.16.14

  What to do

  Affects up to 14.16.14. Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 2, 2026Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2026-93756 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress credentials needed; additionally, the use of v-show rather than v-if means injected HTML — including onerror handlers — is evaluated in the DOM even when the comment section is not visually displayed. When combined with the lack of URL validation in the cff_install_addon AJAX handler (admin/addon-functions.php), an injected script running in an administrator's session can trigger arbitrary plugin installation from an attacker-controlled URL, which may result in server-side code execution.

  Product

  Smash Balloon Social Post Feed – Simple Social Feeds for

  Affected

  up to 4.13.0

  What to do

  Affects up to 4.13.0. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62060 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

  Product

  Captivate Sync

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62059 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

  Product

  Ultimate Member

  Affected

  up to 2.13.1

  What to do

  Affects up to 2.13.1. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026FluentForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows Stored XSS.This issue affects FluentForm: from n/a through 6.2.14.

  Product

  FluentForm

  Affected

  up to 6.2.14

  What to do

  Affects up to 6.2.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Metform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103339 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.

  Product

  Metform

  Affected

  up to 4.3.0

  What to do

  Affects up to 4.3.0. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-103338 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.20

  What to do

  Affects up to 2.0.20. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103064 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026ElementsKit Elementor addons Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103063 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

  Product

  ElementsKit Elementor addons Lite

  Affected

  up to 4.0.6

  What to do

  Affects up to 4.0.6. Update ElementsKit Elementor addons Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102394 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.8.4

  What to do

  Affects up to 6.8.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026BuildKit – Product Builder for WooCommerce – Custom PC Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-102379 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

  Product

  BuildKit – Product Builder for WooCommerce – Custom PC Builder

  Affected

  up to 1.0.28

  What to do

  Affects up to 1.0.28. Update BuildKit – Product Builder for WooCommerce – Custom PC Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026WP Ultimate CSV Importer: Insertion of Sensitive Information Into Sent DataCVE-2026-103336 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1.

  Product

  WP Ultimate CSV Importer

  Affected

  up to 9.1

  What to do

  Affects up to 9.1. Update WP Ultimate CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 1, 2026Simply Schedule Appointments: Sensitive Information ExposureCVE-2026-92245 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.

  Product

  Simply Schedule Appointments

  Affected

  up to 1.6.12.32

  What to do

  Affects up to 1.6.12.32. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 1, 2026Simply Schedule Appointments: Insecure Direct Object ReferenceCVE-2026-91109 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id_token (exposed as public_token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker to possess a valid id_token for any single appointment within the targeted group booking.

  Product

  Simply Schedule Appointments

  Affected

  up to 1.6.12.31

  What to do

  Affects up to 1.6.12.31. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97265 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

  Product

  JetEngine

  Affected

  up to 3.8.15.3

  What to do

  Affects up to 3.8.15.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026VillaTheme CURCY woo-multi-currency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94171 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

  Product

  VillaTheme CURCY woo-multi-currency

  What to do

  Update VillaTheme CURCY woo-multi-currency to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Business Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62097 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

  Product

  Business Directory

  Affected

  up to 6.4.27

  What to do

  Affects up to 6.4.27. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026User Submitted Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62084 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

  Product

  User Submitted Posts

  Affected

  up to 20260810

  What to do

  Affects up to 20260810. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97289 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

  Product

  Quiz And Survey Master

  Affected

  up to 11.2.6

  What to do

  Affects up to 11.2.6. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Event Tickets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-97287 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

  Product

  Event Tickets

  Affected

  up to 5.29.5

  What to do

  Affects up to 5.29.5. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordintrudify.compatchstack.com

• Sep 30, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97286 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

  Product

  Strong Testimonials

  Affected

  up to 3.3.11

  What to do

  Affects up to 3.3.11. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026LayerSlider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97253 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

  Product

  LayerSlider

  Affected

  up to 8.4.0

  What to do

  Affects up to 8.4.0. Update LayerSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97237 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

  Product

  JetEngine

  Affected

  up to 3.8.14.3

  What to do

  Affects up to 3.8.14.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.CVE-2026-96824 · WordPress plugins & themes · reported by PatchstackMedium 6.8

  Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.CVE-2026-94673 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

  Affected

  up to 1.6.12.31

  What to do

  Affects up to 1.6.12.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-94178 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94177 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

  Product

  GamiPress

  Affected

  up to 8.0.2

  What to do

  Affects up to 8.0.2. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 30, 2026Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-94074 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

  Affected

  up to 1.6.12.29

  What to do

  Affects up to 1.6.12.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.