Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

459new WordPress flaws this week

394,717entries in the database

24,748 results · page 1 of 495

Nov 8, 2026FluentForm: Missing AuthorizationCVE-2026-120858 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.
Product
FluentForm
Affected
up to 6.2.16
What to do
Affects up to 6.2.16. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 8, 2026AnyWhere Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-114189 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 8, 2026AnyWhere Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114188 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 8, 2026AnyWhere Elementor: Missing AuthorizationCVE-2026-114186 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
Product
AnyWhere Elementor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update AnyWhere Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 8, 2026Melapress Role Editor: Missing AuthorizationCVE-2026-109899 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.
Product
Melapress Role Editor
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Melapress Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 8, 2026Secure Custom Fields: Does not perform a read-permission checkCVE-2026-97194 · WordPress plugins & themes · reported by WPScanLow 2.7
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
Product
Secure Custom Fields
Fixed in
6.9.8
What to do
Update Secure Custom Fields to 6.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Secure Custom Fields: Does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronizationCVE-2026-97193 · WordPress plugins & themes · reported by WPScanLow 2.7
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
Product
Secure Custom Fields
Fixed in
6.9.8
What to do
Update Secure Custom Fields to 6.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Pie Register: Does not perform an authorisation check in one of its AJAX actionsCVE-2026-96963 · WordPress plugins & themes · reported by WPScanLow 2.7
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
Product
Pie Register
Affected
up to 3.8.4.15
What to do
Affects up to 3.8.4.15. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026FV Flowplayer Video Player: Does not perform any authorization check on an AJAX action that carries out a site-wide content rewriteCVE-2026-85344 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
Product
FV Flowplayer Video Player
Fixed in
7.5.57.7212
What to do
Update FV Flowplayer Video Player to 7.5.57.7212 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Event Tickets Manager for WooCommerce: Does not perform authorisation or a valid nonce check on its ticket-transfer featureCVE-2026-122085 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their choosing, invalidating the legitimate ticket and causing the victim's ticket PDF, which contains attendee personal data, to be sent to the attacker.
Product
Event Tickets Manager for WooCommerce
Fixed in
1.6.0
What to do
Update Event Tickets Manager for WooCommerce to 1.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie: Do not restrict access to stored form submissions through the REST APICVE-2026-122062 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.
Product
Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie
Fixed in
11.1.0
What to do
Update Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie to 11.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026WP Recipe Maker: Does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data outputCVE-2026-122060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
Product
WP Recipe Maker
Fixed in
10.9.2
What to do
Update WP Recipe Maker to 10.9.2 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Contact Form 7: Does not validate the type or extension of files uploaded through a form file fieldCVE-2026-114432 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian or Ubuntu Apache configuration, which lists directory contents and maps .phar to the PHP handler, the stored file can be located and executed, leading to Remote Code Execution. On other configurations, including nginx and Apache with .htaccess overrides enabled, the issue is limited to an arbitrary file written into the uploads directory, which may still be served as active content such as HTML or SVG from the site's own origin.
Product
Contact Form 7
Fixed in
6.2.4
What to do
Update Contact Form 7 to 6.2.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Userplace: Does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects itCVE-2026-110963 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.
Product
Userplace
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Userplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Sync Post With Other Site: Does not properly authorize a content-management action for post types other than pagesCVE-2026-110132 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship.
Product
Sync Post With Other Site
Fixed in
1.9.4
What to do
Update Sync Post With Other Site to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Ecommerce Affiliate: Does not restrict one-time password issuance and verification to the legitimate account ownerCVE-2026-106015 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Product
Ecommerce Affiliate
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ecommerce Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Thanh Toán Quét Mã QR Code Tự Động: Does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installationCVE-2026-105970 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
Product
Thanh Toán Quét Mã QR Code Tự Động
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Thanh Toán Quét Mã QR Code Tự Động to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Razorpay for WooCommerce: Does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL queryCVE-2026-104639 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
Product
Razorpay for WooCommerce
Fixed in
4.8.9
What to do
Update Razorpay for WooCommerce to 4.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Razorpay for WooCommerce: Does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameterCVE-2026-104338 · WordPress plugins & themes · reported by WPScanLow 3.7
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.
Product
Razorpay for WooCommerce
Fixed in
4.8.9
What to do
Update Razorpay for WooCommerce to 4.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Razorpay for WooCommerce: Does not verify ownership of an order before returning a coupon discount computed against that orderCVE-2026-104337 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
Product
Razorpay for WooCommerce
Fixed in
4.8.9
What to do
Update Razorpay for WooCommerce to 4.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authentiCVE-2026-104307 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.
Product
BackUpWordPress
Fixed in
3.15
What to do
Update BackUpWordPress to 3.15 or newer.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Antom Payments: Does not perform any ownership or authorisation check before returning an order's confirmation linkCVE-2026-103375 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email.
Product
Antom Payments
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update Antom Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 8, 2026Turisbook Booking System: Does not have authorisation and CSRF checksCVE-2026-103303 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.
Product
Turisbook Booking System
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Turisbook Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 7, 2026User Registration: Missing AuthorizationCVE-2026-124258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.
Product
User Registration
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026FOX: Missing AuthorizationCVE-2026-123461 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6.
Product
FOX
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Meta Box – WordPress Custom Fields Framework: Missing AuthorizationCVE-2026-120836 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.
Product
Meta Box – WordPress Custom Fields Framework
Affected
up to 5.15.3
What to do
Affects up to 5.15.3. Update Meta Box – WordPress Custom Fields Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026User Registration: Missing AuthorizationCVE-2026-119522 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.
Product
User Registration
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026JetFormBuilder – Hierarchical Select: Authorization Bypass Through User-Controlled KeyCVE-2026-123861 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.
Product
JetFormBuilder – Hierarchical Select
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update JetFormBuilder – Hierarchical Select to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-123860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
Product
JetFormBuilder
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-123483 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.
Product
JetFormBuilder
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Premium Blocks – Gutenberg Blocks for: Missing AuthorizationCVE-2026-123474 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.
Product
Premium Blocks – Gutenberg Blocks for
Affected
up to 2.3.18
What to do
Affects up to 2.3.18. Update Premium Blocks – Gutenberg Blocks for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Motors: Missing AuthorizationCVE-2026-123467 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.
Product
Motors
Affected
up to 1.4.128
What to do
Affects up to 1.4.128. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026myCred: Missing AuthorizationCVE-2026-123462 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
Product
myCred
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Active Products Tables for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-123183 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.
Product
Active Products Tables for WooCommerce
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026CURCY: Missing AuthorizationCVE-2026-122663 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.
Product
CURCY
Affected
up to 2.2.20
What to do
Affects up to 2.2.20. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026FloristPress: Missing AuthorizationCVE-2026-122660 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.
Product
FloristPress
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update FloristPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Fluent Booking: Missing AuthorizationCVE-2026-122659 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.
Product
Fluent Booking
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Checkout Field Editor for WooCommerce (Pro): Unauthorized deletion of arbitrary attachmentsCVE-2026-122041 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service.
Product
Checkout Field Editor for WooCommerce (Pro)
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Checkout Field Editor for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themehigh.com wordfence.com
Nov 7, 2026Cool Formkit Lite: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-121777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.
Product
Cool Formkit Lite
Affected
up to 2.7.10
What to do
Affects up to 2.7.10. Update Cool Formkit Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026CURCY: Missing AuthorizationCVE-2026-121775 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.
Product
CURCY
Affected
up to 2.2.20
What to do
Affects up to 2.2.20. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WP User Manager: Missing AuthorizationCVE-2026-121575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
Product
WP User Manager
Affected
up to 2.10.4
What to do
Affects up to 2.10.4. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-120841 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
Product
WpTravelly
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-120839 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
Product
WpTravelly
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 7, 2026Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay): Stored Cross-Site ScriptingCVE-2026-109973 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.
Product
Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay)
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026WP-Members Membership: Stored Cross-Site ScriptingCVE-2026-96565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.
Product
WP-Members Membership
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Happyforms Pro: Stored Cross-Site ScriptingCVE-2026-93766 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Happyforms Pro
Affected
up to 1.38.9
What to do
Affects up to 1.38.9. Update Happyforms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record happyforms.io wordpress.org
Nov 7, 2026Happyforms: Stored Cross-Site ScriptingCVE-2026-93755 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR request headers without any validation or sanitization, storing the value as post meta ('client_ip') via update_post_meta() during unauthenticated form submissions, and later echoing it in the admin submission edit screen's Details metabox without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator reviewing a submission) accesses an injected page.
Product
Happyforms
Affected
up to 1.38.9
What to do
Affects up to 1.38.9. Update Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record happyforms.io wordfence.com
Nov 7, 2026VikBooking Hotel Booking Engine & PMS: Stored Cross-Site ScriptingCVE-2026-93429 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate is emitted in the publicly accessible pre-checkin form.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.17
What to do
Affects up to 1.8.17. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Church Admin: Stored Cross-Site ScriptingCVE-2026-123418 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present.
Product
Church Admin
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Nov 7, 2026Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-119498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.
Product
Simple Cloudflare Turnstile
Affected
up to 1.44.4
What to do
Affects up to 1.44.4. Update Simple Cloudflare Turnstile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.