Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

2,713 results · page 1 of 55

Oct 29, 2026the load_popup_content REST endpoint that: Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access controlCVE-2026-119325 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.
Product
the load_popup_content REST endpoint that
What to do
Update the load_popup_content REST endpoint that to the newest version.
Full record and what to do →NVD record bricksbuilder.io vulncheck.com
Oct 29, 2026Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.CVE-2026-42701 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.CVE-2026-108494 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026HivePress Claim Listings: Missing AuthorizationCVE-2026-42707 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
Product
HivePress Claim Listings
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script viaCVE-2026-119054 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
Fixed in
4.2.5
What to do
Update the plugin to 4.2.5 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Oct 29, 2026download_remote_file that: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgeryCVE-2026-118989 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Product
download_remote_file that
Fixed in
2.6.8
What to do
Update download_remote_file that to 2.6.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Sensitive Information ExposureCVE-2026-91153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Reflected Cross-Site ScriptingCVE-2026-91152 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · WordPress plugins & themes · reported by WPScanLow 3.7
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Contact Form by Supsystic: Does not verify a CSRF nonce before saving its mail settingsCVE-2026-115299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
Product
Contact Form by Supsystic
Fixed in
1.11.1
What to do
Update Contact Form by Supsystic to 1.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Chat AI with Dispatcher: Does not properly validate uploaded filesCVE-2026-115245 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.
Product
Chat AI with Dispatcher
Fixed in
2.4
What to do
Update Chat AI with Dispatcher to 2.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026LogixFast Auth: Does not deliver its password-reset one-time code to the resolved account's own email addressCVE-2026-113616 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Product
LogixFast Auth
Fixed in
1.0.4
What to do
Update LogixFast Auth to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS): Do not bind the account whose two-factor code is verified to the account being authenticatedCVE-2026-111739 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
Product
Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)
Fixed in
1.17.0
What to do
Update Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) to 1.17.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitCVE-2026-118804 · WordPress plugins & themes · reported by VulnCheckHigh 7.5
Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record bricksbuilder.io vulncheck.com
Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Product
the update_fees AJAX handler that
Fixed in
1.1.10.9
What to do
Update the update_fees AJAX handler that to 1.1.10.9 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026GetPaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
Product
GetPaid
Affected
up to 2.8.62
What to do
Affects up to 2.8.62. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2026Essential Addons for Elementor: Does not apply its administrator approval requirement to accounts registered through its email one-time-password flowCVE-2026-110508 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Product
Essential Addons for Elementor
Fixed in
6.8.7
What to do
Update Essential Addons for Elementor to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Elementor Addons: Does not validate submitted form field values before substituting them into the recipient addresses of its form notification emailsCVE-2026-106648 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
Product
Royal Elementor Addons
Fixed in
1.7.1070
What to do
Update Royal Elementor Addons to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Waitlist Woocommerce ( Back in stock notifier ): Stored Cross-Site ScriptingCVE-2026-77188 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on contributor post save does not prevent this vulnerability because shortcode attribute values are not HTML and pass through kses unchanged; the payload is materialized only at render time when the shortcode is expanded.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Stored Cross-Site ScriptingCVE-2026-118169 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustle_edit_module capability, but the plugin's built-in Permissions screen allows administrators to delegate this capability to lower roles including Subscriber, enabling Subscriber-level exploitation on sites where that delegation has been configured.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.14.3
What to do
Affects up to 7.8.14.3. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026AI ChatBot for WooCommerce – WoowBot: Authorization bypassCVE-2026-111372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.
Product
AI ChatBot for WooCommerce – WoowBot
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update AI ChatBot for WooCommerce – WoowBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026MxChat – AI Chatbot & Content Generation for: Stored DOM-Based Cross-Site ScriptingCVE-2026-110662 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page.
Product
MxChat – AI Chatbot & Content Generation for
Affected
up to 3.2.25
What to do
Affects up to 3.2.25. Update MxChat – AI Chatbot & Content Generation for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More: Local File InclusionCVE-2026-110185 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires that an administrator has built a webhook-triggered flow that pipes a webhook body field into an ImageHelper imageToBase64 node, and that the webhook remains in its default configuration (no bearer secret enforced, no IP allowlist set) — a legitimate and documented use case.
Product
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks: Stored Cross-Site ScriptingCVE-2026-109385 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.
Product
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution: Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2026-108366 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Stored Cross-Site ScriptingCVE-2026-107710 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.
Product
Hustle – Email Marketing, Lead Generation, Optins, Popups
Affected
up to 7.8.14.3
What to do
Affects up to 7.8.14.3. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Tainacan: Directory TraversalCVE-2026-104743 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The poisoned importer path is persisted to the database and later triggered via a separate GET request to the /source_info endpoint, which passes the attacker-controlled path to fopen() and fgetcsv() and returns parsed file contents in the REST response.
Product
Tainacan
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 28, 2026Customer Engagement System: Does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to itCVE-2026-115225 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Welcart e-Commerce: Does not properly verify authorization against the targeted product before processing SKU changesCVE-2026-111032 · WordPress plugins & themes · reported by WPScanLow 3.8
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
Product
Welcart e-Commerce
Fixed in
2.12.6
What to do
Update Welcart e-Commerce to 2.12.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Customer Email Verification for WooCommerce: Authentication BypassCVE-2026-109236 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined.
Product
Customer Email Verification for WooCommerce
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Customer Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Royal Addons for Elementor: Does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the requestCVE-2026-107097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Royal Addons for Elementor: Does not scope a contact form's email delivery configuration to the form's own document or ownerCVE-2026-106647 · WordPress plugins & themes · reported by WPScanLow 3.8
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.
Product
Royal Addons for Elementor
Fixed in
1.7.1070
What to do
Update Royal Addons for Elementor to 1.7.1070 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Booking Package: Does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side stateCVE-2026-105997 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.
Product
Booking Package
Fixed in
1.7.33
What to do
Update Booking Package to 1.7.33 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2026-1928 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.276
What to do
Affects up to 1.0.276. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnCVE-2026-109999 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 27, 2026AI Engine – The Chatbot, AI Framework & MCP for: Limited media file deletionCVE-2026-107745 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.4
What to do
Affects up to 3.8.4. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2026AI Engine: Missing AuthorizationCVE-2026-112828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
Product
AI Engine
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Popup Builder: Does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requestsCVE-2026-112230 · WordPress plugins & themes · reported by WPScanLow 3.7
The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.
Product
Popup Builder
Fixed in
4.4.6
What to do
Update Popup Builder to 4.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Paid Member Subscriptions: Missing AuthorizationCVE-2026-112842 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
Product
Paid Member Subscriptions
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Waitlist Woocommerce ( Back in stock notifier ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-114701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.
Product
Waitlist Woocommerce ( Back in stock notifier )
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Waitlist Woocommerce ( Back in stock notifier ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
Product
Contact Form Email
Affected
up to 1.3.68
What to do
Affects up to 1.3.68. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111830 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.
Product
WP Mailster
Affected
up to 1.9.1.0
What to do
Affects up to 1.9.1.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Product
Infility Global
Fixed in
2.16.25
What to do
Update Infility Global to 2.16.25 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Tailored Tools: Cross-Site Request Forgery (CSRF)CVE-2026-111401 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3.
Product
Tailored Tools
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.
Product
Paid Videochat Turnkey Site
Affected
up to 7.5.14
What to do
Affects up to 7.5.14. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026WP Mailster: Unrestricted Upload of File with Dangerous TypeCVE-2026-111832 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.
Product
WP Mailster
Affected
up to 1.9.1.0
What to do
Affects up to 1.9.1.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 21, 2026SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publCVE-2026-114120 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Fixed in
5.3.5
What to do
Update the plugin to 5.3.5 or newer.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026HappyForms: Does not sanitise or escape a user-controlled referral value before embedding it in the form notification emailCVE-2026-14556 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Product
HappyForms
Fixed in
1.26.15
What to do
Update HappyForms to 1.26.15 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026LatePoint: Does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allowCVE-2026-105256 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
Product
LatePoint
Fixed in
5.7.5
What to do
Update LatePoint to 5.7.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026Simple Shopping Cart: Does not verify submitted product prices against a value only the site owner can setCVE-2026-104642 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.
Product
Simple Shopping Cart
Fixed in
5.3.3
What to do
Update Simple Shopping Cart to 5.3.3 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.