Vulnerability database

15,357 results · page 9 of 308

• Oct 15, 2026VK Blocks: Stored Cross-Site ScriptingCVE-2026-78087 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  VK Blocks

  Affected

  up to 1.126.1

  What to do

  Affects up to 1.126.1. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Stored Cross-Site ScriptingCVE-2026-78001 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Post and Page Builder by BoldGrid – Visual Drag and Drop Editor

  Affected

  up to 1.27.13

  What to do

  Affects up to 1.27.13. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Premium Packages – Sell Digital Products Securely: Unauthenticated Stored Cross-Site ScriptingCVE-2026-18586 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Premium Packages – Sell Digital Products Securely

  Affected

  up to 7.0.5

  What to do

  Affects up to 7.0.5. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-18557 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Photo Gallery by 10Web – Mobile-Friendly Image Gallery

  Affected

  up to 1.8.42

  What to do

  Affects up to 1.8.42. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Stored Cross-Site ScriptingCVE-2026-18548 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Groundhogg — CRM, Newsletters, and Marketing Automation

  Affected

  up to 4.5.14

  What to do

  Affects up to 4.5.14. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 15, 2026Import and export users and customers: Stored Cross-Site ScriptingCVE-2026-17001 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Import and export users and customers

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Tracking Code Manager: Reflected Cross-Site ScriptingCVE-2026-15180 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Tracking Code Manager

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 15, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-14572 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Kirki – Freeform Page Builder, Website Builder & Customizer

  Affected

  up to 6.2.0

  What to do

  Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Best Payments Plugin for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108484 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

  Product

  Best Payments Plugin for WP

  Affected

  up to 4.6.27

  What to do

  Affects up to 4.6.27. Update Best Payments Plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026Hippoo Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.

  Product

  Hippoo Mobile App for WooCommerce

  Affected

  up to 1.12.0

  What to do

  Affects up to 1.12.0. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026SimplyRETS Real Estate IDX: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105066 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.

  Product

  SimplyRETS Real Estate IDX

  Affected

  up to 3.2.9

  What to do

  Affects up to 3.2.9. Update SimplyRETS Real Estate IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107870 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

  Product

  JetEngine

  Affected

  up to 3.8.16

  What to do

  Affects up to 3.8.16. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026JetProductTables: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107867 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

  Product

  JetProductTables

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update JetProductTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026WP w3all phpBB: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107422 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.

  Product

  WP w3all phpBB

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105874 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

  Product

  SureCart

  Affected

  up to 4.9.3

  What to do

  Affects up to 4.9.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.

  Product

  WPForms Lite

  Fixed in

  2.0.2.2

  What to do

  Update WPForms Lite to 2.0.2.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107428 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

  Product

  Paid Videochat Turnkey Site

  Affected

  up to 7.5.12

  What to do

  Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 14, 2026Gallery Custom Links: Stored Cross-Site ScriptingCVE-2026-107757 · WordPress plugins & themes · reported by WordfenceMedium 4.9

  The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.

  Product

  Gallery Custom Links

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Meow Lightbox: Stored Cross-Site ScriptingCVE-2026-107756 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.

  Product

  Meow Lightbox

  Affected

  up to 5.6.2

  What to do

  Affects up to 5.6.2. Update Meow Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107754 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

  Affected

  up to 2.8.190

  What to do

  Affects up to 2.8.190. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 14, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-107751 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.

  Product

  Mang Board

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107650 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  GeoDirectory – WP Business Directory Plugin and Classified Listings Directory

  Affected

  up to 2.8.190

  What to do

  Affects up to 2.8.190. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 14, 2026Record of Consent Extension for Complianz: Stored Cross-Site ScriptingCVE-2026-107631 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

  Product

  Record of Consent Extension for Complianz

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Record of Consent Extension for Complianz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-104761 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Mang Board

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026PeproDev Branches Map: Stored Cross-Site ScriptingCVE-2025-9373 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  PeproDev Branches Map

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update PeproDev Branches Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 14, 2026AWP Classifieds: Does not verify that a request is authorised to view a listingCVE-2026-96904 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any listing.

  Product

  AWP Classifieds

  Fixed in

  4.4.9

  What to do

  Update AWP Classifieds to 4.4.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Cart Abandonment Recovery for WooCommerce: Does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting itCVE-2026-96900 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that customer's stored abandoned-cart data.

  Product

  Cart Abandonment Recovery for WooCommerce

  Fixed in

  2.1.4

  What to do

  Update Cart Abandonment Recovery for WooCommerce to 2.1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026YITH WooCommerce Popup: Does not check the capability of the requesting user before deleting post metaCVE-2026-92426 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

  Product

  YITH WooCommerce Popup

  Fixed in

  1.60.0

  What to do

  Update YITH WooCommerce Popup to 1.60.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of an incoming payment-notification request before acting on the order named in itCVE-2026-91076 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

  Product

  Robokassa payment gateway for Woocommerce

  Fixed in

  1.9.0

  What to do

  Update Robokassa payment gateway for Woocommerce to 1.9.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026affiliate-toolkit: Does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executesCVE-2026-86787 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

  Product

  affiliate-toolkit

  Fixed in

  3.9.1

  What to do

  Update affiliate-toolkit to 3.9.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Sunshine Photo Cart: Does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its imagesCVE-2026-108069 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).

  Product

  Sunshine Photo Cart

  Fixed in

  3.7.4

  What to do

  Update Sunshine Photo Cart to 3.7.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026WP Encryption: Does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routineCVE-2026-108064 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.

  Product

  WP Encryption

  Fixed in

  7.8.8.2

  What to do

  Update WP Encryption to 7.8.8.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10

  The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.

  Product

  File Upload to Order

  Fixed in

  1.1.4

  What to do

  Update File Upload to Order to 1.1.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Image Photo Gallery Final Tiles Grid: Does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the galleryCVE-2026-107178 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.

  Product

  Image Photo Gallery Final Tiles Grid

  Fixed in

  3.6.16

  What to do

  Update Image Photo Gallery Final Tiles Grid to 3.6.16 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026WP Booking System: Does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screenCVE-2026-107126 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.

  Product

  WP Booking System

  Fixed in

  2.1.0.1

  What to do

  Update WP Booking System to 2.1.0.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Classified Listing: Does not verify that the requester owns or can edit the target listingCVE-2026-106646 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.

  Product

  Classified Listing

  Fixed in

  6.1.1

  What to do

  Update Classified Listing to 6.1.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 14, 2026Social Share Buttons & Analytics Plugin – GetSocial.io: Stored Cross-Site ScriptingCVE-2026-103369 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the gs-alert-msg, gs-alert-utm, and gs-alert-cta WordPress options and executes in an administrator's browser when the GetSocial settings page is visited.

  Product

  Social Share Buttons & Analytics Plugin – GetSocial.io

  Affected

  up to 4.5

  What to do

  Affects up to 4.5. Update Social Share Buttons & Analytics Plugin – GetSocial.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026NewStatPress: Stored Cross-Site ScriptingCVE-2026-101924 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.

  Product

  NewStatPress

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update NewStatPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2026-97398 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.

  Product

  FV Flowplayer Video Player

  Affected

  up to 7.5.54.7212

  What to do

  Affects up to 7.5.54.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026PO/MO Editor: Stored Cross-Site ScriptingCVE-2026-97020 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is loaded as a replacement .po/.mo translation file via the plugin's own load_textdomain_mofile filter, causing WordPress to serve the attacker-written translation in place of the original core strings.

  Product

  PO/MO Editor

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update PO/MO Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2026-95816 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.

  Product

  Smart Forms – when you need more than just a contact form

  Affected

  up to 2.6.104

  What to do

  Affects up to 2.6.104. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026FV Player 8: Stored Cross-Site ScriptingCVE-2026-95807 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.

  Product

  FV Player 8

  Affected

  up to 8.1.7

  What to do

  Affects up to 8.1.7. Update FV Player 8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 14, 2026Verified Reviews (Avis Vérifiés): Stored Cross-Site ScriptingCVE-2026-94377 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.

  Product

  Verified Reviews (Avis Vérifiés)

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update Verified Reviews (Avis Vérifiés) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Stored Cross-Site ScriptingCVE-2026-93885 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.

  Product

  Cryptocurrency Donation Box – Bitcoin & Crypto Donations

  Affected

  up to 2.2.13

  What to do

  Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Contact Form DB for Enfold: Stored Cross-Site ScriptingCVE-2026-83592 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.

  Product

  Contact Form DB for Enfold

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Contact Form DB for Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Document Gallery: Stored Cross-Site ScriptingCVE-2026-77114 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

  Product

  Document Gallery

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Countdown Timer – Widget Countdown: Stored Cross-Site ScriptingCVE-2026-16495 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Countdown Timer – Widget Countdown

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Countdown Timer – Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 14, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-100193 · WordPress plugins & themes · reported by WordfenceMedium 4.7

  The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink.

  Product

  Tutor LMS – eLearning and online course solution

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-100185 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.

  Product

  Directorist: AI-Powered Business Directory, Listings & Classified Ads

  Affected

  up to 8.10.2.1

  What to do

  Affects up to 8.10.2.1. Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 14, 2026NewStatPress: Stored Cross-Site ScriptingCVE-2026-100153 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.

  Product

  NewStatPress

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update NewStatPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.