Vulnerability database

3,866 results · page 1 of 78

• Oct 31, 2026Germanized for WooCommerce: Unauthorized Access of Private DataCVE-2026-109231 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have doub

  Product

  Germanized for WooCommerce

  Affected

  up to 4.1.4

  What to do

  Affects up to 4.1.4. Update Germanized for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 31, 2026Perfect Images: Unauthorized modification of dataCVE-2025-11455 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.

  Product

  Perfect Images

  Affected

  up to 7.2.0

  What to do

  Affects up to 7.2.0. Update Perfect Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 31, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory: Unauthorized account accessCVE-2026-119980 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy use

  Product

  UsersWP – Front-end login form, User Registration, User Profile & Members Directory

  Affected

  up to 1.2.78

  What to do

  Affects up to 1.2.78. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Oct 31, 2026WP Booking System - Booking Calendar: Unauthorized modification of dataCVE-2026-116557 · WordPress plugins & themes · reported by WordfenceCritical 9.1

  The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.

  Product

  WP Booking System - Booking Calendar

  Affected

  up to 2.1.0.5

  What to do

  Affects up to 2.1.0.5. Update WP Booking System - Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 31, 2026Photo Reviews for WooCommerce: Unauthorized Media Library File DeletionCVE-2026-110251 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the `delete_reviews_image()` function's `delete_comment` hook trusting attachment IDs supplied via the `wcpr_image_upload_id` POST parameter that were stored in comment meta without any ownership or capability check — `viwcpr_filter_review_image_ids()` verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by `wp_delete_attachment()` — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's `wp_scheduled_delete` cron to purge it after `EMPTY_TRASH_DAYS`. The nonce required to submit the parameter (`wcpr_image_upload`) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account.

  Product

  Photo Reviews for WooCommerce

  Affected

  up to 1.2.31

  What to do

  Affects up to 1.2.31. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 31, 2026Premium Packages: Does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cartCVE-2026-118184 · WordPress plugins & themes · reported by WPScan

  The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.

  Product

  Premium Packages

  Fixed in

  7.2.2

  What to do

  Update Premium Packages to 7.2.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.CVE-2026-94175 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.CVE-2026-90888 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.CVE-2026-54855 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

  Affected

  up to 4.0.5

  What to do

  Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.CVE-2026-48201 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

  Affected

  up to 3.5.7

  What to do

  Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.CVE-2026-39786 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

  Affected

  up to 1.8.33

  What to do

  Affects up to 1.8.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.CVE-2026-39738 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

  Affected

  up to 3.8.6.1

  What to do

  Affects up to 3.8.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.CVE-2026-39734 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

  Affected

  up to 4.5.4

  What to do

  Affects up to 4.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.CVE-2026-39732 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

  Affected

  up to 2.5.13

  What to do

  Affects up to 2.5.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.CVE-2026-28160 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.

  Affected

  up to 1.4.10

  What to do

  Affects up to 1.4.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.CVE-2026-116862 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

  Affected

  up to 2026.3.1

  What to do

  Affects up to 2026.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.CVE-2026-116861 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.CVE-2026-116853 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

  Affected

  up to 4.19.0.1

  What to do

  Affects up to 4.19.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.CVE-2026-116851 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

  Affected

  up to 3.6.5

  What to do

  Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.CVE-2026-116847 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.

  Affected

  up to 2.4.6

  What to do

  Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.CVE-2026-116410 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

  Affected

  up to 3.4.3

  What to do

  Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.CVE-2026-116405 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.CVE-2026-116401 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.CVE-2026-116386 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.CVE-2026-115947 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.CVE-2026-107868 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.

  Affected

  up to 4.34.0

  What to do

  Affects up to 4.34.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.CVE-2026-105077 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.

  Affected

  up to 2.8.19

  What to do

  Affects up to 2.8.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 30, 2026My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcCVE-2026-119714 · WordPress plugins & themes · reported by VulnCheckMedium 6.9

  My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

  Fixed in

  3.8.11

  What to do

  Update the plugin to 3.8.11 or newer.

  Full record and what to do →NVD recordgithub.comgithub.com

• Oct 30, 2026Content Egg: Unauthorized modification of dataCVE-2026-119059 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators.

  Product

  Content Egg

  Affected

  up to 12.0.0

  What to do

  Affects up to 12.0.0. Update Content Egg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5

  Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.

  Product

  the load_popup_content REST endpoint that

  What to do

  Update the load_popup_content REST endpoint that to the newest version.

  Full record and what to do →NVD recordbricksbuilder.iovulncheck.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.CVE-2026-62131 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

  Affected

  up to 2.14.5

  What to do

  Affects up to 2.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.CVE-2026-62018 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.CVE-2026-62017 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  Affected

  up to 1.3.13

  What to do

  Affects up to 1.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.CVE-2026-62016 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

  Affected

  up to 1.19

  What to do

  Affects up to 1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.CVE-2026-62015 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.CVE-2026-62014 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.CVE-2026-62013 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.CVE-2026-62012 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.CVE-2026-62011 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.CVE-2026-62010 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

  Affected

  up to 1.1.12

  What to do

  Affects up to 1.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.CVE-2026-62009 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.CVE-2026-62008 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.CVE-2026-62006 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.CVE-2026-62005 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

  Affected

  up to 1.15

  What to do

  Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.CVE-2026-62004 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

  Affected

  up to 1.11

  What to do

  Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Mission <= 1.22 versions.CVE-2026-62003 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

  Affected

  up to 1.22

  What to do

  Affects up to 1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.CVE-2026-62002 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

  Affected

  up to 1.1.13

  What to do

  Affects up to 1.1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.CVE-2026-62001 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

  Affected

  up to 1.2.14

  What to do

  Affects up to 1.2.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.CVE-2026-61998 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 29, 2026Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.CVE-2026-61997 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.