Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,566 results · page 1 of 232
Oct 31, 2026SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications: Arbitrary File UploadCVE-2026-118235 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.
- Product
- SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
- Affected
- up to 3.10.2
- What to do
- Affects up to 3.10.2. Update SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026Newsletters: Time-based SQL InjectionCVE-2026-101325 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.
- Product
- Newsletters
- Affected
- up to 4.18.1
- What to do
- Affects up to 4.18.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: Remote Code ExecutionCVE-2026-116512 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.
- Product
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026WP2LEADS: Time-based SQL InjectionCVE-2025-9462 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP2LEADS
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update WP2LEADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026Perfect Images: Unauthorized modification of dataCVE-2025-11455 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.
- Product
- Perfect Images
- Affected
- up to 7.2.0
- What to do
- Affects up to 7.2.0. Update Perfect Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 31, 2026FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: Time-based SQL InjectionCVE-2026-119163 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.
- Product
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- Affected
- up to 3.8.5.2
- What to do
- Affects up to 3.8.5.2. Update FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026Spectra Gutenberg Blocks – Website Builder for the Block Editor: Limited file deletionCVE-2026-92294 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to delete theme files on the server.
- Product
- Spectra Gutenberg Blocks – Website Builder for the Block Editor
- Affected
- up to 2.20.4
- What to do
- Affects up to 2.20.4. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026Firelight Lightbox: Does not properly escape image attribute values before processing them in the browserCVE-2026-118438 · WordPress plugins & themes · reported by WPScan
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
- Product
- Firelight Lightbox
- Fixed in
- 2.3.24
- What to do
- Update Firelight Lightbox to 2.3.24 or newer.
Oct 31, 2026Security Optimizer: Does not limit the number of two-factor authentication codes that can be submitted for a pending loginCVE-2026-118185 · WordPress plugins & themes · reported by WPScan
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
- Product
- Security Optimizer
- Fixed in
- 1.6.9
- What to do
- Update Security Optimizer to 1.6.9 or newer.
Oct 30, 2026Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.CVE-2026-78527 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
- Affected
- up to 3.3.10
- What to do
- Affects up to 3.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-62121 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.26
- What to do
- Affects up to 2.0.26. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Divi Contact Form 7: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-62057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
- Product
- Divi Contact Form 7
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Divi Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-62023 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.26
- What to do
- Affects up to 2.0.26. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026GIFTiT – Free Gifts for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-52710 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
- Product
- GIFTiT – Free Gifts for WooCommerce
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update GIFTiT – Free Gifts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Ultimate Addons for Elementor - Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
- Product
- Ultimate Addons for Elementor - Lite
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Ultimate Addons for Elementor - Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.
- Product
- Media Player Addons for Elementor – Media Player widget for WP
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Media Player Addons for Elementor – Media Player widget for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-119479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
- Product
- JetFormBuilder
- Affected
- up to 3.6.7.1
- What to do
- Affects up to 3.6.7.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119369 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Blocksy Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.
- Product
- Blocksy Companion
- Affected
- up to 2.1.60
- What to do
- Affects up to 2.1.60. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-119370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.
- Product
- The Events Calendar
- Affected
- up to 6.18.2
- What to do
- Affects up to 6.18.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Timetics: Missing AuthorizationCVE-2026-116860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
- Product
- Timetics
- Affected
- up to 1.0.65
- What to do
- Affects up to 1.0.65. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2026Content Egg – Affiliate Product Importer & Price Comparison: Authorization bypassCVE-2026-119087 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user.
- Product
- Content Egg – Affiliate Product Importer & Price Comparison
- Affected
- up to 12.0.0
- What to do
- Affects up to 12.0.0. Update Content Egg – Affiliate Product Importer & Price Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-117572 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboardCVE-2026-117571 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 8.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Oct 30, 2026Security Plugin, Firewall & Malware Scanner with Auto Removal: Does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracksCVE-2026-114444 · WordPress plugins & themes · reported by WPScanMedium 4.4
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.
- Product
- Security Plugin, Firewall & Malware Scanner with Auto Removal
- Fixed in
- 2.191
- What to do
- Update Security Plugin, Firewall & Malware Scanner with Auto Removal to 2.191 or newer.
Oct 30, 2026Forminator Forms: Limited File DeletionCVE-2026-5461 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
- Product
- Forminator Forms
- Affected
- up to 1.55.0.2
- What to do
- Affects up to 1.55.0.2. Update Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026Export and Import Users and Customers: Privilege EscalationCVE-2026-104368 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026Kirki: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-42694 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
- Product
- Kirki
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 6.5.3
- What to do
- Affects up to 6.5.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026EventPrime: Authorization Bypass Through User-Controlled KeyCVE-2026-42691 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
- Product
- EventPrime
- Affected
- up to 4.3.6.0
- What to do
- Affects up to 4.3.6.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39742 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.
- Product
- Gutenberg Blocks by Kadence Blocks
- Affected
- up to 3.8.0.2
- What to do
- Affects up to 3.8.0.2. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
- Product
- JetElements For Elementor
- Affected
- up to 2.9.2.6
- What to do
- Affects up to 2.9.2.6. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Flash & HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-118097 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.
- Product
- Flash & HTML5 Video
- Affected
- up to 2.14.0
- What to do
- Affects up to 2.14.0. Update Flash & HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-118095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.50.1
- What to do
- Affects up to 3.50.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026StreamCast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116849 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.
- Product
- StreamCast
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update StreamCast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026PublishPress Authors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
- Product
- PublishPress Authors
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.
- Product
- Strong Testimonials
- Affected
- up to 3.3.15
- What to do
- Affects up to 3.3.15. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026SureDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
- Product
- SureDash
- Affected
- up to 1.12.3
- What to do
- Affects up to 1.12.3. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Import and export users and customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
- Product
- Import and export users and customers
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Brave: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-48202 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
- Product
- Brave
- Affected
- up to 0.8.8
- What to do
- Affects up to 0.8.8. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026PDF Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
- Product
- PDF Poster
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update PDF Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026HivePress Claim Listings: Missing AuthorizationCVE-2026-42707 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39736 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
- Product
- JetEngine
- Affected
- up to 3.9.0.1
- What to do
- Affects up to 3.9.0.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026User Registration: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-25467 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.
- Product
- User Registration
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116857 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.
- Product
- JetSmartFilters
- Affected
- up to 3.8.6.2
- What to do
- Affects up to 3.8.6.2. Update JetSmartFilters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026SureForms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-116402 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.
- Product
- SureForms
- Affected
- up to 2.12.9
- What to do
- Affects up to 2.12.9. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026The Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
- Product
- The Post Grid
- Affected
- up to 7.9.7
- What to do
- Affects up to 7.9.7. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Video Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-52709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.
- Product
- Video Gallery Block
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Video Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2026Kali Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48196 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.
- Product
- Kali Forms
- Affected
- up to 2.4.27
- What to do
- Affects up to 2.4.27. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.