Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,534 results · page 9 of 111
Oct 16, 2026Salon Booking System: Does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking statusCVE-2026-110014 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
- Product
- Salon Booking System
- Fixed in
- 10.31.9
- What to do
- Update Salon Booking System to 10.31.9 or newer.
Oct 16, 2026Salon Booking System: Does not generate its booking-API access tokens from a secure random sourceCVE-2026-110013 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
- Product
- Salon Booking System
- Fixed in
- 10.31.9
- What to do
- Update Salon Booking System to 10.31.9 or newer.
Oct 16, 2026Salon Booking System: Does not restrict several of its booking REST API routes to users with the appropriate capabilityCVE-2026-110012 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
- Product
- Salon Booking System
- Fixed in
- 10.31.3
- What to do
- Update Salon Booking System to 10.31.3 or newer.
Oct 16, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check or validate a nonce on its migration actionsCVE-2026-109982 · WordPress plugins & themes · reported by WPScanMedium 4.2
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
- Product
- MB Custom Post Types & Custom Taxonomies
- Fixed in
- 2.12.2
- What to do
- Update MB Custom Post Types & Custom Taxonomies to 2.12.2 or newer.
Oct 16, 2026Visual Form Builder: Does not perform an authorization check before displaying recent form submission data in a dashboard widgetCVE-2026-105974 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
- Product
- Visual Form Builder
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Visual Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Visual Form Builder: Does not perform authorization or nonce checksCVE-2026-105973 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.
- Product
- Visual Form Builder
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Visual Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Mobile builder: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-103696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Tutor LMS: Does not perform a capability check in a routine that regenerates its managed pagesCVE-2026-96537 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
- Product
- Tutor LMS
- Fixed in
- 4.1.1
- What to do
- Update Tutor LMS to 4.1.1 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92429 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Oct 15, 2026Rede Itaú for WooCommerce: Does not verify the authenticity of a payment gateway webhook before updating an order's statusCVE-2026-92428 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
- Product
- Rede Itaú for WooCommerce
- Fixed in
- 5.5.3
- What to do
- Update Rede Itaú for WooCommerce to 5.5.3 or newer.
Oct 15, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX actionCVE-2026-74920 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
- Product
- Document Gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026User Rights Access Manager: Does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was createdCVE-2026-109145 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
- Product
- User Rights Access Manager
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Spin Wheel: Does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize couponCVE-2026-106031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
- Product
- Spin Wheel
- Fixed in
- 2.2.1
- What to do
- Update Spin Wheel to 2.2.1 or newer.
Oct 15, 2026Easy HTTPS Redirection (SSL): Does not perform capability checks in some of its AJAX actionsCVE-2026-104643 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
- Product
- Easy HTTPS Redirection (SSL)
- Fixed in
- 2.0.2
- What to do
- Update Easy HTTPS Redirection (SSL) to 2.0.2 or newer.
Oct 15, 2026Cardinity Payment Gateway for WooCommerce: Does not properly verify the authenticity of the payment notifications it receivesCVE-2026-103324 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
- Product
- Cardinity Payment Gateway for WooCommerce
- Fixed in
- 3.4.2
- What to do
- Update Cardinity Payment Gateway for WooCommerce to 3.4.2 or newer.
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
- Product
- eaSYNC Booking
- Fixed in
- 1.3.31
- What to do
- Update eaSYNC Booking to 1.3.31 or newer.
Oct 14, 2026Responsive Blocks: Does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site ownerCVE-2026-97315 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
- Product
- Responsive Blocks
- Fixed in
- 2.3.0
- What to do
- Update Responsive Blocks to 2.3.0 or newer.
Oct 14, 2026Tickera: Does not correctly verify the integrity of incoming payment notificationsCVE-2026-88998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.
- Product
- Tickera
- Fixed in
- 3.6.0.4
- What to do
- Update Tickera to 3.6.0.4 or newer.
Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
- Product
- WPForms Lite
- Fixed in
- 2.0.2.2
- What to do
- Update WPForms Lite to 2.0.2.2 or newer.
Oct 14, 2026Visma Pay for WooCommerce: Does not verify the authenticity of payment gateway return requestsCVE-2026-103308 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
- Product
- Visma Pay for WooCommerce
- Fixed in
- 1.2.2
- What to do
- Update Visma Pay for WooCommerce to 1.2.2 or newer.
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
- Product
- WPCode
- Fixed in
- 2.4.0
- What to do
- Update WPCode to 2.4.0 or newer.
Oct 14, 2026AWP Classifieds: Does not verify that a request is authorised to view a listingCVE-2026-96904 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.
- Product
- AWP Classifieds
- Fixed in
- 4.4.9
- What to do
- Update AWP Classifieds to 4.4.9 or newer.
Oct 14, 2026Cart Abandonment Recovery for WooCommerce: Does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting itCVE-2026-96900 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.
- Product
- Cart Abandonment Recovery for WooCommerce
- Fixed in
- 2.1.4
- What to do
- Update Cart Abandonment Recovery for WooCommerce to 2.1.4 or newer.
Oct 14, 2026Paymentfor Gateway for WooCommerce: Does not verify the authenticity of an inbound payment notification before marking an orderCVE-2026-94360 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.
- Product
- Paymentfor Gateway for WooCommerce
- Fixed in
- 1.0.6
- What to do
- Update Paymentfor Gateway for WooCommerce to 1.0.6 or newer.
Oct 14, 2026Sifalo Pay: Does not verify that a payment transaction identifier belongs to the order it is confirmingCVE-2026-94261 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
- Product
- Sifalo Pay
- Fixed in
- 2.5.3
- What to do
- Update Sifalo Pay to 2.5.3 or newer.
Oct 14, 2026Sifalo Pay: Does not verify ownership ofCVE-2026-94260 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.
- Product
- Sifalo Pay
- Fixed in
- 2.5.3
- What to do
- Update Sifalo Pay to 2.5.3 or newer.
Oct 14, 2026SellKit: Does not validate a client-supplied product priceCVE-2026-94254 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.
- Product
- SellKit
- Fixed in
- 2.8.0
- What to do
- Update SellKit to 2.8.0 or newer.
Oct 14, 2026YITH WooCommerce Popup: Does not check the capability of the requesting user before deleting post metaCVE-2026-92426 · WordPress plugins & themes · reported by WPScanMedium 4.9
The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.
- Product
- YITH WooCommerce Popup
- Fixed in
- 1.60.0
- What to do
- Update YITH WooCommerce Popup to 1.60.0 or newer.
Oct 14, 2026Donation Thermometer: Does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markupCVE-2026-92409 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.
- Product
- Donation Thermometer
- Fixed in
- 2.3.0
- What to do
- Update Donation Thermometer to 2.3.0 or newer.
Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.
- Product
- Robokassa payment gateway for Woocommerce
- Fixed in
- 1.9.0
- What to do
- Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.
Oct 14, 2026Tainacan: Does not restrict its reports REST endpoints to users with a management capabilityCVE-2026-90989 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
- Product
- Tainacan
- Fixed in
- 1.4.0
- What to do
- Update Tainacan to 1.4.0 or newer.
Oct 14, 2026Fast Courier: Does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST routeCVE-2026-89288 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
- Product
- Fast Courier
- Fixed in
- 5.2.4
- What to do
- Update Fast Courier to 5.2.4 or newer.
Oct 14, 2026rtMedia for WordPress, BuddyPress and bbPress: Does not verify that a user owns or may write to the album an upload is assigned toCVE-2026-88927 · WordPress plugins & themes · reported by WPScanMedium 4.3
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Fixed in
- 4.7.14
- What to do
- Update rtMedia for WordPress, BuddyPress and bbPress to 4.7.14 or newer.
Oct 14, 2026Asaas Gateway for WooCommerce: Does not properly authenticate its payment webhookCVE-2026-87974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
- Product
- Asaas Gateway for WooCommerce
- Fixed in
- 2.7.8
- What to do
- Update Asaas Gateway for WooCommerce to 2.7.8 or newer.
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
- Product
- Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
- Fixed in
- 5.3.2
- What to do
- Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Oct 14, 2026Trust Payments Gateway for WooCommerce: Does not verify the authenticity of the payment provider's responseCVE-2026-87843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
- Product
- Trust Payments Gateway for WooCommerce
- Fixed in
- 3.1.0
- What to do
- Update Trust Payments Gateway for WooCommerce to 3.1.0 or newer.
Oct 14, 2026Forms: Does not sanitise submitted form values on storageCVE-2026-86799 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
- Product
- Forms
- Fixed in
- 3.0.2
- What to do
- Update Forms to 3.0.2 or newer.
Oct 14, 2026Pricing Table: Does not validate the scheme of a user-supplied link value in one of its blocks before rendering itCVE-2026-86797 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content.
- Product
- Pricing Table
- Fixed in
- 2.1.5
- What to do
- Update Pricing Table to 2.1.5 or newer.
Oct 14, 2026affiliate-toolkit: Does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executesCVE-2026-86787 · WordPress plugins & themes · reported by WPScanHigh 7.2
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
- Product
- affiliate-toolkit
- Fixed in
- 3.9.1
- What to do
- Update affiliate-toolkit to 3.9.1 or newer.
Oct 14, 2026FV Flowplayer Video Player: Does not properly validate a user-supplied URL before performing a server-side fetchCVE-2026-85345 · WordPress plugins & themes · reported by WPScanMedium 4.1
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.55.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.55.7212 or newer.
Oct 14, 2026EmbedPress: Does not perform any capability or nonce check on an unauthenticated request that triggers a server-sideCVE-2026-85000 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.
- Product
- EmbedPress
- Fixed in
- 4.6.8
- What to do
- Update EmbedPress to 4.6.8 or newer.
Oct 14, 2026Sunshine Photo Cart: Does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its imagesCVE-2026-108069 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
- Product
- Sunshine Photo Cart
- Fixed in
- 3.7.4
- What to do
- Update Sunshine Photo Cart to 3.7.4 or newer.
Oct 14, 2026WP 2FA: Does not perform an object-level capability check before removing a user's two-factor authentication configurationCVE-2026-108066 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
- Product
- WP 2FA
- Fixed in
- 4.2.0
- What to do
- Update WP 2FA to 4.2.0 or newer.
Oct 14, 2026WP Encryption: Does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routineCVE-2026-108064 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.
- Product
- WP Encryption
- Fixed in
- 7.8.8.2
- What to do
- Update WP Encryption to 7.8.8.2 or newer.
Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
- Product
- File Upload to Order
- Fixed in
- 1.1.4
- What to do
- Update File Upload to Order to 1.1.4 or newer.
Oct 14, 2026Ultimate Multisite: Does not validate a user-supplied value used to select a file to includeCVE-2026-107508 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
- Product
- Ultimate Multisite
- Fixed in
- 2.17.2
- What to do
- Update Ultimate Multisite to 2.17.2 or newer.
Oct 14, 2026GamiPress: Does not properly authorize access to private activity log entriesCVE-2026-107320 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
- Product
- GamiPress
- Fixed in
- 8.0.6
- What to do
- Update GamiPress to 8.0.6 or newer.
Oct 14, 2026GamiPress: Does not perform a capability check or ownership verification on one of its authenticated AJAX actionsCVE-2026-107319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
- Product
- GamiPress
- Fixed in
- 8.0.6
- What to do
- Update GamiPress to 8.0.6 or newer.
Oct 14, 2026Image Photo Gallery Final Tiles Grid: Does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the galleryCVE-2026-107178 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.16
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.16 or newer.
Oct 14, 2026LTL Freight Quotes: Does not perform any authorization check or input sanitization before storing certain values from a requestCVE-2026-107160 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
- Product
- LTL Freight Quotes
- Fixed in
- 4.2.19
- What to do
- Update LTL Freight Quotes to 4.2.19 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.