Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

18,987 results · page 1 of 380

Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Reflected Cross-Site ScriptingCVE-2026-91152 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-116763 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
Product
LiteSpeed Cache
Affected
up to 7.9.1
What to do
Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026HT Mega Addons for Elementor – Elementor Widgets & Template Builder: Stored DOM-Based Cross-Site ScriptingCVE-2026-111318 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.
Product
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update HT Mega Addons for Elementor – Elementor Widgets & Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-110707 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-109215 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.
Product
LiteSpeed Cache
Affected
up to 7.9.1
What to do
Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 29, 2026Mapster WP Maps: Stored Cross-Site ScriptingCVE-2026-107743 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mapster WP Maps
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-107629 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.1
What to do
Affects up to 13.2.1. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Greenshift – animation and page builder blocks: Stored DOM-Based Cross-Site ScriptingCVE-2026-107627 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
Product
Greenshift – animation and page builder blocks
Affected
up to 13.2.1
What to do
Affects up to 13.2.1. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Sequential Order Numbers for WooCommerce: Stored Cross-Site ScriptingCVE-2026-104727 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sequential Order Numbers for WooCommerce
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Sequential Order Numbers for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Media Library Assistant: Reflected Cross-Site ScriptingCVE-2026-103875 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} token, along with enough attachments to trigger pagination.
Product
Media Library Assistant
Affected
up to 3.42
What to do
Affects up to 3.42. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Extensions for Leaflet Map: Stored DOM-Based Cross-Site ScriptingCVE-2026-103485 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example, through compromise of an external data host, a subdomain takeover, or a site intentionally pointing at an attacker-hosted feed.
Product
Extensions for Leaflet Map
Affected
up to 5.4
What to do
Affects up to 5.4. Update Extensions for Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · WordPress plugins & themes · reported by WPScanLow 3.7
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Password Protected: Stored Cross-Site ScriptingCVE-2026-93293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after an administrator clicks "Allow & Continue"), the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without any capability, nonce, or purchase validation, and stores it in a persistent, site-wide administrative notice. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that execute automatically when an administrator views a standard admin page such as their Profile page.
Product
Password Protected
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Password Protected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org ti.wordfence.io
Oct 29, 2026Video Player for YouTube: Does not perform a capability check on its player-preset AJAX handlerCVE-2026-85007 · WordPress plugins & themes · reported by WPScan
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
Product
Video Player for YouTube
Fixed in
2.1.4
What to do
Update Video Player for YouTube to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Link Library: Does not re-check the selected library's own login requirementCVE-2026-78395 · WordPress plugins & themes · reported by WPScan
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
Product
Link Library
Fixed in
7.10.0
What to do
Update Link Library to 7.10.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engineCVE-2026-115301 · WordPress plugins & themes · reported by WPScan
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScan
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Automated Import Products to Cart: Does not sanitize a user-supplied file path before using it to read and delete filesCVE-2026-113617 · WordPress plugins & themes · reported by WPScan
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
Product
Automated Import Products to Cart
Fixed in
1.0.4
What to do
Update Automated Import Products to Cart to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026LogixFast Auth: Does not deliver its password-reset one-time code to the resolved account's own email addressCVE-2026-113616 · WordPress plugins & themes · reported by WPScan
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Product
LogixFast Auth
Fixed in
1.0.4
What to do
Update LogixFast Auth to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS): Do not bind the account whose two-factor code is verified to the account being authenticatedCVE-2026-111739 · WordPress plugins & themes · reported by WPScan
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
Product
Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)
Fixed in
1.17.0
What to do
Update Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) to 1.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Photo Album Plus: Does not verify the origin or a security token for one of its comment-management requestsCVE-2026-110983 · WordPress plugins & themes · reported by WPScan
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Product
WP Photo Album Plus
Fixed in
9.3.04.004
What to do
Update WP Photo Album Plus to 9.3.04.004 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Hide Price Until Login: Does not restrict a guest-registration handler and does not honour the site's user-registration settingCVE-2026-110030 · WordPress plugins & themes · reported by WPScan
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
Product
Hide Price Until Login
Fixed in
1.1.2
What to do
Update Hide Price Until Login to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not check that the account was created before updating its profile during front-end registrationCVE-2026-108685 · WordPress plugins & themes · reported by WPScan
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Appointment Booking: Does not escape several booking-form step content settings before rendering them on the public booking formCVE-2026-105258 · WordPress plugins & themes · reported by WPScan
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Product
Appointment Booking
Fixed in
5.7.6
What to do
Update Appointment Booking to 5.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026DSGVO All in one for WP: Stored Cross-Site ScriptingCVE-2026-96741 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator.
Product
DSGVO All in one for WP
Affected
up to 5.0
What to do
Affects up to 5.0. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Food Store – Online Food Delivery & Pickup: Stored Cross-Site ScriptingCVE-2026-96669 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel.
Product
Food Store – Online Food Delivery & Pickup
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Food Store – Online Food Delivery & Pickup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Schema App Structured Data: Stored Cross-Site ScriptingCVE-2026-96666 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled the plugin's 'Remove Microdata' option and approves the malicious comment.
Product
Schema App Structured Data
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026SendPress Newsletters: Time-based SQL InjectionCVE-2026-93855 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.
Product
SendPress Newsletters
Affected
up to 1.26.1.20
What to do
Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting.CVE-2026-113409 · WordPress plugins & themes · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.8
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
Product
Ortto
Fixed in
1.0.25
What to do
Update Ortto to 1.0.25 or newer.
Full record and what to do →NVD record trust.canva.com
Oct 28, 2026Ninja Forms: Incomplete server-side validationCVE-2026-67187 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
Product
Ninja Forms
Fixed in
3.15.4
What to do
Update Ninja Forms to 3.15.4 or newer.
Full record and what to do →NVD record wordpress.org vulncheck.com
Oct 28, 2026WP Discussion Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through 2.6.0.
Product
WP Discussion Board
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WP Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.
Product
SliceWP
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026GetPaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
Product
GetPaid
Affected
up to 2.8.62
What to do
Affects up to 2.8.62. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026DXP ToolKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.
Product
DXP ToolKit
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update DXP ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
Product
eCommerce Product Catalog
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115593 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.24
What to do
Affects up to 2.0.24. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Smart Popup by Supsystic: Does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engineCVE-2026-115223 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
Product
Smart Popup by Supsystic
Fixed in
2.0.2
What to do
Update Smart Popup by Supsystic to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Essential Addons for Elementor: Does not apply its administrator approval requirement to accounts registered through its email one-time-password flowCVE-2026-110508 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Product
Essential Addons for Elementor
Fixed in
6.8.7
What to do
Update Essential Addons for Elementor to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026MemberPress: Cross-Site Request ForgeryCVE-2026-92797 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing the security check to be completely bypassed by simply omitting the nonce parameter from the request. This makes it possible for unauthenticated attackers to change authenticated users' email addresses via a forged request granted they can trick an authenticated user into performing an action such as clicking on a link, leading to account takeover through password reset functionality.
Product
MemberPress
Affected
up to 1.14.1
What to do
Affects up to 1.14.1. Update MemberPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberpress.com wordfence.com
Oct 28, 2026Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search: Reflected Cross-Site ScriptingCVE-2026-101935 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.
Product
Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search
Affected
up to 17.214.0
What to do
Affects up to 17.214.0. Update Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Webheadcoder Multi-Step Forms for Contact Form 7: Reflected Cross-Site ScriptingCVE-2026-92098 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_print_after' parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the targeted site has at least one Contact Form 7 form configured with a [multistep] form-tag, as the canonicalization introduced in version 4.7 blocks the attack path on non-multistep forms.
Product
Webheadcoder Multi-Step Forms for Contact Form 7
Affected
up to 4.7
What to do
Affects up to 4.7. Update Webheadcoder Multi-Step Forms for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026Post Snippets – Custom WordPress Code Snippets Customizer: Stored Cross-Site ScriptingCVE-2026-77871 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as <script>...</script> survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled.
Product
Post Snippets – Custom WordPress Code Snippets Customizer
Affected
up to 4.2.4
What to do
Affects up to 4.2.4. Update Post Snippets – Custom WordPress Code Snippets Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Waitlist Woocommerce ( Back in stock notifier ): Stored Cross-Site ScriptingCVE-2026-77188 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on contributor post save does not prevent this vulnerability because shortcode attribute values are not HTML and pass through kses unchanged; the payload is materialized only at render time when the shortcode is expanded.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026WP Inventory Manager: Time-based SQL InjectionCVE-2026-76005 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited by a Contributor via the [wpinventory_categories] shortcode embedded in a draft post rendered through preview, without requiring the post to be published.
Product
WP Inventory Manager
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Advanced Custom Fields: Extended: Unauthorized access of data and triggering of server-side actionsCVE-2026-2839 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of server-side actions in all versions up to, and including, 0.9.2.7. This is due to multiple AJAX handlers registered for unauthenticated users (`wp_ajax_nopriv_*`) that fail to implement proper `current_user_can()` authorization checks. While these handlers use ACF's `acf_verify_ajax()` function to validate cryptographic nonces, the `acf_nonce` values are generated for guest users and publicly exposed in the page source of any frontend page utilizing an ACF form. This makes it possible for unauthenticated attackers to extract the guest nonce and bypass WordPress visibility permissions, leading to the unauthorized disclosure of post titles and internal Flexible Content layout structures. The vulnerability was partially patched in version 0.9.2.4.
Product
Advanced Custom Fields: Extended
Affected
up to 0.9.2.7
What to do
Affects up to 0.9.2.7. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Stored Cross-Site ScriptingCVE-2026-118169 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustle_edit_module capability, but the plugin's built-in Permissions screen allows administrators to delegate this capability to lower roles including Subscriber, enabling Subscriber-level exploitation on sites where that delegation has been configured.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.14.3
What to do
Affects up to 7.8.14.3. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026If-So Dynamic Content – Elementor & All Page Builders Personalization: Stored Cross-Site ScriptingCVE-2026-118164 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repeater[*][version_uid] (and many sibling fields: freeze-mode, cookie-input, ip-input, compare, utm-value, page-url-compare, group-name, custom, …)' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
If-So Dynamic Content – Elementor & All Page Builders Personalization
Affected
up to 1.10.2
What to do
Affects up to 1.10.2. Update If-So Dynamic Content – Elementor & All Page Builders Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026CMB2: Stored Cross-Site ScriptingCVE-2026-116761 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.
Product
CMB2
Affected
up to 2.13.4
What to do
Affects up to 2.13.4. Update CMB2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Stored Cross-Site ScriptingCVE-2026-116749 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. wp_kses_post() applied at save time does not neutralize the payload because the injection lands in an HTML-attribute context where only a raw double-quote is needed to break out, and block-comment JSON encoding of that quote is decoded back to a literal character by do_blocks() at render time.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026VikRentCar Car Rental Management System: Cross-Site Request ForgeryCVE-2026-111120 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Product
VikRentCar Car Rental Management System
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update VikRentCar Car Rental Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.