Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

3,902 results · page 9 of 79

Sep 23, 2026Forminator Forms: Does not perform a nonceCVE-2026-87069 · WordPress plugins & themes · reported by WPScanLow 3.1
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
Product
Real3D Flipbook
Fixed in
5.4
What to do
Update Real3D Flipbook to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Post Grid Gutenberg Blocks: Does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given postCVE-2026-86783 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
Product
Post Grid Gutenberg Blocks
Fixed in
5.0.41
What to do
Update Post Grid Gutenberg Blocks to 5.0.41 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026WP Recipe Maker: Does not perform any capability check in one of its AJAX actionsCVE-2026-86602 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.
Product
WP Recipe Maker
Fixed in
10.8.2
What to do
Update WP Recipe Maker to 10.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Events Calendar: Does not perform a per-object capability check on one family of its REST write routesCVE-2026-84743 · WordPress plugins & themes · reported by WPScanLow 3.8
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
Product
Events Calendar
Fixed in
6.17.5
What to do
Update Events Calendar to 6.17.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026MasterStudy LMS: Does not perform a per-object ownership checkCVE-2026-81339 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026zportals: Does not perform any capability or nonce check on one of its AJAX actionsCVE-2026-18365 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators.
Product
zportals
Fixed in
6.4.2
What to do
Update zportals to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026zportals: Does not perform any capability or nonce check on several of its AJAX actionsCVE-2026-18364 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
Product
zportals
Fixed in
6.4.2
What to do
Update zportals to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Newsletters: Does not perform an ownership check on some of its subscriber management actionsCVE-2026-16264 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
Product
Newsletters
Fixed in
4.18.1
What to do
Update Newsletters to 4.18.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026jet-form-builder-stripe-gateway: Does not sanitise and escape a payment token before using it in a SQL statementCVE-2022-4997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
Product
jet-form-builder-stripe-gateway
Fixed in
1.1.0
What to do
Update jet-form-builder-stripe-gateway to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026WP-CRM System – Manage Clients and Projects: Sensitive Information ExposureCVE-2026-9004 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
Product
WP-CRM System – Manage Clients and Projects
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP-CRM System – Manage Clients and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor.CVE-2026-94504 · WordPress plugins & themes · reported by WordfenceHigh 7.2
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, whicCVE-2026-92438 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Meow Gallery: Does not perform a proper capability check or restrict results to the requesting user's own posts before returning post dataCVE-2026-92423 · WordPress plugins & themes · reported by WPScanLow 2.7
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
Product
Meow Gallery
Fixed in
5.5.5
What to do
Update Meow Gallery to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Tripzzy: Does not perform any capability or ownership checks on its administrative booking-management actionsCVE-2026-87840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Product
Tripzzy
Fixed in
1.5.1
What to do
Update Tripzzy to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Forminator Forms: Does not apply the role validation it enforces elsewhereCVE-2026-87068 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Forminator Forms: Does not restrictCVE-2026-87067 · WordPress plugins & themes · reported by WPScanHigh 8.5
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Unlimited Elements For Elementor: Does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through itCVE-2026-85017 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Product
Unlimited Elements For Elementor
Fixed in
2.0.20
What to do
Update Unlimited Elements For Elementor to 2.0.20 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026WordLift – AI powered SEO – Schema: Sensitive Information ExposureCVE-2026-9289 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.
Product
WordLift – AI powered SEO – Schema
Affected
up to 3.54.10
What to do
Affects up to 3.54.10. Update WordLift – AI powered SEO – Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026YS LeadGen: Sensitive Information ExposureCVE-2026-1255 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.
Product
YS LeadGen
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update YS LeadGen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Easy Appointments: Sensitive Information ExposureCVE-2026-9232 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
Product
Easy Appointments
Affected
up to 3.12.27
What to do
Affects up to 3.12.27. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary shortcode executionCVE-2026-85658 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.17.2
What to do
Affects up to 4.17.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Bread: Information exposureCVE-2026-4792 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
Product
Bread
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update Bread to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Quill Forms | Conversational Multi Step Forms, Surveys & quizzes: Stored Cross-Site ScriptingCVE-2026-15664 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.
Product
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update Quill Forms | Conversational Multi Step Forms, Surveys & quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not perform object-level authorisation checks on several of its host-management operationsCVE-2026-92425 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Fixed in
1.2.4
What to do
Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Secure Custom Fields: Does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitorCVE-2026-92403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
Product
Secure Custom Fields
Fixed in
6.9.4
What to do
Update Secure Custom Fields to 6.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Botiga Pro: Does not perform any authorisation checks on one of its REST routesCVE-2026-86591 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
Product
Botiga Pro
Fixed in
1.6.5
What to do
Update Botiga Pro to 1.6.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Unbounce Landing Pages: Does not perform any authorisation checkCVE-2026-85574 · WordPress plugins & themes · reported by WPScanHigh 8
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.
Product
Unbounce Landing Pages
Fixed in
1.1.5
What to do
Update Unbounce Landing Pages to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Ultra Addons for Contact Form 7: Does not validate the type or extension of files uploaded through one of its form fieldsCVE-2026-84750 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
Product
Ultra Addons for Contact Form 7
Fixed in
3.5.51
What to do
Update Ultra Addons for Contact Form 7 to 3.5.51 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026JetFormBuilder — Dynamic Blocks Form Builder: Does not sufficiently restrictCVE-2026-19860 · WordPress plugins & themes · reported by WPScanMedium 5.5
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Fixed in
3.6.5.3
What to do
Update JetFormBuilder — Dynamic Blocks Form Builder to 3.6.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Nimble Page Builder: Does not perform an authorization checkCVE-2026-16557 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Product
Nimble Page Builder
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update Nimble Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-92229 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.2
What to do
Affects up to 1.57.2. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Information Exposure by SpoofingCVE-2026-89093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Gravity Forms: Arbitrary File UploadCVE-2026-84434 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.
Product
Gravity Forms
Affected
up to 3.1.0.4
What to do
Affects up to 3.1.0.4. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.gravityforms.com wordfence.com
Sep 18, 2026Divi Essential: Sensitive information exposureCVE-2026-15760 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).
Product
Divi Essential
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Divi Essential to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record divinext.com wordfence.com
Sep 18, 2026NEX-Forms – Ultimate Forms Plugin for: Generic SQL InjectionCVE-2026-75961 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The operator allowlist applied by get_table_records() when building its own WHERE fragment is not enforced on the same tainted additional_params array when it is forwarded to get_total_records(), leaving the SQL sink unprotected.
Product
NEX-Forms – Ultimate Forms Plugin for
Affected
up to 9.3.0
What to do
Affects up to 9.3.0. Update NEX-Forms – Ultimate Forms Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Easy Pay – Payment and Donation form Builder for Square: Authorization bypassCVE-2026-12739 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Product
WP Easy Pay – Payment and Donation form Builder for Square
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Easy Pay – Payment and Donation form Builder for Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI: Sensitive Information ExposureCVE-2026-89278 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.
Product
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
Affected
up to 2.34.6
What to do
Affects up to 2.34.6. Update GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Generate PDF using Contact Form 7: Does not restrict the destination of the image fetch its PDF renderer performs on submitted form contentCVE-2026-90984 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
Product
Generate PDF using Contact Form 7
Fixed in
4.2.2
What to do
Update Generate PDF using Contact Form 7 to 4.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Bookit — Booking & Appointment Calendar: Does not perform an authorization check on one of its appointment-retrieval actionsCVE-2026-89008 · WordPress plugins & themes · reported by WPScanLow 2.7
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
Product
Bookit — Booking & Appointment Calendar
Fixed in
2.6.0.5
What to do
Update Bookit — Booking & Appointment Calendar to 2.6.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Bookit — Booking & Appointment Calendar: Does not perform a capability check in one of its appointment-deletion functionsCVE-2026-89007 · WordPress plugins & themes · reported by WPScanLow 2.7
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
Product
Bookit — Booking & Appointment Calendar
Fixed in
2.6.0.5
What to do
Update Bookit — Booking & Appointment Calendar to 2.6.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Appointments: Does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied idCVE-2026-87966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85123 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85122 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
Product
Easy Form Builder by WhiteStudio
Fixed in
4.2.0
What to do
Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform per-object authorization checks on a group of image-optimization actionsCVE-2026-84904 · WordPress plugins & themes · reported by WPScanLow 3.8
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform any capabilityCVE-2026-84903 · WordPress plugins & themes · reported by WPScanLow 2.7
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026King Addons for Elementor: Does not perform an object-level authorization checkCVE-2026-84902 · WordPress plugins & themes · reported by WPScanMedium 6.8
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Product
King Addons for Elementor
Fixed in
51.1.81
What to do
Update King Addons for Elementor to 51.1.81 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026All-in-One WP Migration and Backup: Does not perform any capability check on several of its AJAX actionsCVE-2026-81810 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
Product
All-in-One WP Migration and Backup
Fixed in
7.111
What to do
Update All-in-One WP Migration and Backup to 7.111 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Product
MasterStudy LMS
Fixed in
3.7.50
What to do
Update MasterStudy LMS to 3.7.50 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.