Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,534 results · page 1 of 111
Nov 7, 2026Advanced Custom Fields (ACF®): Does not re-apply its field-group location rulesCVE-2026-97191 · WordPress plugins & themes · reported by WPScan
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to administrators onto their own posts.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 7, 2026Advanced Custom Fields (ACF®): Does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronizationCVE-2026-97190 · WordPress plugins & themes · reported by WPScan
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to their own object on arbitrary posts, users, or terms they cannot otherwise edit.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 7, 2026Advanced Custom Fields (ACF®): Does not perform a read-permission checkCVE-2026-97189 · WordPress plugins & themes · reported by WPScan
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 7, 2026Komfortkasse for WooCommerce: Does not properly validate the authenticity of REST API requestsCVE-2026-122001 · WordPress plugins & themes · reported by WPScan
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.
- Product
- Komfortkasse for WooCommerce
- Fixed in
- 1.4.9
- What to do
- Update Komfortkasse for WooCommerce to 1.4.9 or newer.
Nov 7, 2026iLeads SMS Gateway by Exsile: Does not check capabilities or nonces in several AJAX actions that update a site option chosen by the requestCVE-2026-121866 · WordPress plugins & themes · reported by WPScan
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
- Product
- iLeads SMS Gateway by Exsile
- Fixed in
- 2.0.0
- What to do
- Update iLeads SMS Gateway by Exsile to 2.0.0 or newer.
Nov 7, 2026Event Tickets with Ticket Scanner: Does not properly escape a search value before using it in SQL queries in several of its admin listingsCVE-2026-121858 · WordPress plugins & themes · reported by WPScan
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 3.2.9
- What to do
- Update Event Tickets with Ticket Scanner to 3.2.9 or newer.
Nov 7, 2026Event Tickets with Ticket Scanner: Does not check that a user may manage WooCommerce orders before returning or removing ticket data for any orderCVE-2026-121857 · WordPress plugins & themes · reported by WPScan
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 3.1.14
- What to do
- Update Event Tickets with Ticket Scanner to 3.1.14 or newer.
Nov 7, 2026Magic Link: Does not check that the user requesting a login link is authorised to generate one for the chosen accountCVE-2026-121848 · WordPress plugins & themes · reported by WPScan
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
- Product
- Magic Link
- Fixed in
- 2.2.6
- What to do
- Update Magic Link to 2.2.6 or newer.
Nov 7, 2026Add From Server Lite: Does not restrict SVG uploads to users allowed to post unfiltered HTMLCVE-2026-121796 · WordPress plugins & themes · reported by WPScan
The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.
- Product
- Add From Server Lite
- Fixed in
- 6.0.0
- What to do
- Update Add From Server Lite to 6.0.0 or newer.
Nov 7, 2026Fiber Admin: Does not have authorisation checks in some of its AJAX actionsCVE-2026-121492 · WordPress plugins & themes · reported by WPScan
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
- Product
- Fiber Admin
- Fixed in
- 4.0.1
- What to do
- Update Fiber Admin to 4.0.1 or newer.
Nov 7, 2026Fiber Admin: Does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hookCVE-2026-121491 · WordPress plugins & themes · reported by WPScan
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
- Product
- Fiber Admin
- Fixed in
- 4.0.1
- What to do
- Update Fiber Admin to 4.0.1 or newer.
Nov 7, 2026Tournamatch: Does not restrict access to its team invitation listingCVE-2026-121380 · WordPress plugins & themes · reported by WPScan
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
- Product
- Tournamatch
- Fixed in
- 4.7.1
- What to do
- Update Tournamatch to 4.7.1 or newer.
Nov 7, 2026Tournamatch: Does not validate or restrict the path of a previously stored profile or team image before deleting itCVE-2026-121379 · WordPress plugins & themes · reported by WPScan
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
- Product
- Tournamatch
- Fixed in
- 4.7.1
- What to do
- Update Tournamatch to 4.7.1 or newer.
Nov 7, 2026Live Composer: Does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attributeCVE-2026-119073 · WordPress plugins & themes · reported by WPScan
The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Live Composer
- Fixed in
- 2.1.23
- What to do
- Update Live Composer to 2.1.23 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting userCVE-2026-118534 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the user requesting an order's payment receipt owns that orderCVE-2026-118533 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify ownership of attachment IDs suppliedCVE-2026-118532 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check that the acting user may edit each targeted userCVE-2026-118530 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that a user owns a listing before processing a featured-listing checkout for itCVE-2026-118529 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX actionCVE-2026-118528 · WordPress plugins & themes · reported by WPScan
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
- Product
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Fixed in
- 8.11
- What to do
- Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.11 or newer.
Nov 7, 2026WP Google Review Slider: Does not perform nonce validationCVE-2026-117588 · WordPress plugins & themes · reported by WPScan
The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.
- Product
- WP Google Review Slider
- Fixed in
- 18.11
- What to do
- Update WP Google Review Slider to 18.11 or newer.
Nov 7, 2026FV Flowplayer Video Player: Does not escape shortcode attribute values embedded in comments before rendering them into the media player markupCVE-2026-117525 · WordPress plugins & themes · reported by WPScan
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.5.57.7212
- What to do
- Update FV Flowplayer Video Player to 7.5.57.7212 or newer.
Nov 7, 2026Live Composer: Does not sanitise and escape some of its custom post type slug settings before using them in front-end linksCVE-2025-15708 · WordPress plugins & themes · reported by WPScan
The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them in front-end links, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Live Composer
- Fixed in
- 2.1.23
- What to do
- Update Live Composer to 2.1.23 or newer.
Nov 6, 2026Quick Event Manager: Does not verify the authenticity of PayPal payment notifications before marking event registrationsCVE-2026-121636 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
- Product
- Quick Event Manager
- Fixed in
- 9.19
- What to do
- Update Quick Event Manager to 9.19 or newer.
Nov 6, 2026Order Tracking: Does not verify that a PayPal payment notification was sent to the merchant's accountCVE-2026-121633 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
- Product
- Order Tracking
- Fixed in
- 3.6.0
- What to do
- Update Order Tracking to 3.6.0 or newer.
Nov 6, 2026The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to uploCVE-2026-118423 · WordPress plugins & themes · reported by WPScanCritical 10
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
- What to do
- Update the plugin to the newest version.
Nov 6, 2026MC4WP: Mailchimp for: Does not prevent request-derived values in its dynamic content tags from being processedCVE-2026-118166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
- Product
- MC4WP: Mailchimp for
- Fixed in
- 4.15.0
- What to do
- Update MC4WP: Mailchimp for to 4.15.0 or newer.
Nov 6, 2026ShopEngine Gutenberg WooCommerce Builder Blocks Addon: Does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actionsCVE-2026-92396 · WordPress plugins & themes · reported by WPScanMedium 6.8
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
- Product
- ShopEngine Gutenberg WooCommerce Builder Blocks Addon
- Fixed in
- 2.4.4
- What to do
- Update ShopEngine Gutenberg WooCommerce Builder Blocks Addon to 2.4.4 or newer.
Nov 6, 2026Cool Media Filter: Does not perform any capability or nonce checkCVE-2026-87784 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
- Product
- Cool Media Filter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Cool Media Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: Does not properly escape content it re-emits through its bundled HTML parserCVE-2026-86606 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
- Product
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
- Fixed in
- 3.13.7
- What to do
- Update iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more to 3.13.7 or newer.
Nov 6, 2026WCFM Membership: Does not verify that payment was made before completing a paid membershipCVE-2026-12967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
- Product
- WCFM Membership
- Fixed in
- 2.12.1
- What to do
- Update WCFM Membership to 2.12.1 or newer.
Nov 6, 2026All-in-One Video Gallery: Does not escape a video's stored thumbnail URL before outputting it in the admin video listCVE-2026-120408 · WordPress plugins & themes · reported by WPScanHigh 8
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.1.0
- What to do
- Update All-in-One Video Gallery to 5.1.0 or newer.
Nov 6, 2026All-in-One Video Gallery: Does not check the typeCVE-2026-119259 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
- Product
- All-in-One Video Gallery
- Fixed in
- 5.1.0
- What to do
- Update All-in-One Video Gallery to 5.1.0 or newer.
Nov 6, 2026AutomatorWP: Does not check that the user completing its Zoom and AWeber integration connections is allowed to do soCVE-2026-118239 · WordPress plugins & themes · reported by WPScanMedium 5.6
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
- Product
- AutomatorWP
- Fixed in
- 6.0.7
- What to do
- Update AutomatorWP to 6.0.7 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user is permitted to read a given post before returning its content through its revision-comparison featureCVE-2026-118188 · WordPress plugins & themes · reported by WPScanMedium 4.3
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not verify that a user requesting to duplicate or revise a post has access to that specific postCVE-2026-118187 · WordPress plugins & themes · reported by WPScanLow 2.7
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes: Does not correctly restrict who may publish contentCVE-2026-118186 · WordPress plugins & themes · reported by WPScanMedium 4.9
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
- Product
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- Fixed in
- 4.3.1
- What to do
- Update PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes to 4.3.1 or newer.
Nov 6, 2026MC4WP: Mailchimp for: Does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site ownerCVE-2026-118167 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
- Product
- MC4WP: Mailchimp for
- Fixed in
- 4.15.0
- What to do
- Update MC4WP: Mailchimp for to 4.15.0 or newer.
Nov 6, 2026Ever Accounting: Does not restrict the file path supplied to its CSV import routine to an allowed directoryCVE-2026-118045 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
- Product
- Ever Accounting
- Fixed in
- 2.3.3
- What to do
- Update Ever Accounting to 2.3.3 or newer.
Nov 6, 2026Static Snapshot: Does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the serverCVE-2026-116533 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
- Product
- Static Snapshot
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Static Snapshot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026Anti-Spam, Spam FireWall by CleanTalk: Does not escape a commenter-supplied value before outputting it on an administrative spam-review screenCVE-2026-115673 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.
- Product
- Anti-Spam, Spam FireWall by CleanTalk
- Fixed in
- 6.91
- What to do
- Update Anti-Spam, Spam FireWall by CleanTalk to 6.91 or newer.
Nov 6, 2026WHIZZ: Does not validate the password-reset key before updating a user's passwordCVE-2026-115230 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
- Product
- WHIZZ
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WHIZZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026GutenKit: Does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published pageCVE-2026-114427 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
- Product
- GutenKit
- Fixed in
- 2.5.5
- What to do
- Update GutenKit to 2.5.5 or newer.
Nov 6, 2026GS JWT Authentication for WP REST API: Does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routesCVE-2026-113615 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
- Product
- GS JWT Authentication for WP REST API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update GS JWT Authentication for WP REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026placester: Does not perform any capabilityCVE-2026-113584 · WordPress plugins & themes · reported by WPScanCritical 9.8
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.
- Product
- placester
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update placester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026Wurdey: Does not verify a request signature before logging a user inCVE-2026-110955 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
- Product
- Wurdey
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Wurdey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026Advanced Custom Fields (ACF®): Does not properly sanitize a stored field definition that can be modified through its comment handlingCVE-2026-110813 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
- Product
- Advanced Custom Fields (ACF®)
- Fixed in
- 6.8.11
- What to do
- Update Advanced Custom Fields (ACF®) to 6.8.11 or newer.
Nov 6, 2026Mail Mage: Does not properly sanitise and escape a user-supplied value before using it in a SQL statementCVE-2026-110532 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Mail Mage
- Affected
- up to 0.0.25
- What to do
- Affects up to 0.0.25. Update Mail Mage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026MCB: Does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics gridCVE-2026-110525 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
- Product
- MCB
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update MCB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2026Dokan: Does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment orderCVE-2026-107776 · WordPress plugins & themes · reported by WPScanLow 2.2
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
- Product
- Dokan
- Fixed in
- 5.3.3
- What to do
- Update Dokan to 5.3.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.