Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
484 results · page 1 of 10
Oct 30, 2026User Frontend: Does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX responseCVE-2026-115277 · WordPress plugins & themes · reported by WPScanMedium 4.7
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.
- Product
- User Frontend
- Fixed in
- 4.3.14
- What to do
- Update User Frontend to 4.3.14 or newer.
Oct 29, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-116763 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
- Product
- LiteSpeed Cache
- Affected
- up to 7.9.1
- What to do
- Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-109215 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.
- Product
- LiteSpeed Cache
- Affected
- up to 7.9.1
- What to do
- Affects up to 7.9.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 24, 2026LiteSpeed Cache: Insertion of Sensitive Information Into Sent DataCVE-2026-114190 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.
- Product
- LiteSpeed Cache
- Affected
- up to 7.9
- What to do
- Affects up to 7.9. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2026Download Monitor: Does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the pageCVE-2026-112207 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
- Product
- Download Monitor
- Fixed in
- 5.3.4
- What to do
- Update Download Monitor to 5.3.4 or newer.
Oct 23, 2026LiteSpeed Cache: Does not perform a capability check on its admin-notice dismissal handlerCVE-2026-113501 · WordPress plugins & themes · reported by WPScanLow 3.1
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 23, 2026LiteSpeed Cache: Does not limit one of its HTML optimization routines to stylesheet contentCVE-2026-113500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 23, 2026LiteSpeed Cache: Does not restrict one of its HTML rewriting routines to stylesheet contentCVE-2026-113499 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
- Product
- LiteSpeed Cache
- Fixed in
- 7.9.2
- What to do
- Update LiteSpeed Cache to 7.9.2 or newer.
Oct 21, 2026Booking Package: Does not perform authorization checks before returning calendar-account configuration in a responseCVE-2026-105999 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
- Product
- Booking Package
- Fixed in
- 1.7.31
- What to do
- Update Booking Package to 1.7.31 or newer.
Oct 20, 2026The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectiCVE-2026-82814 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordduplicator.complugins.trac.wordpress.org
Oct 19, 2026Snap Finance: Does not verify that the payment provider's response actually confirms a completedCVE-2026-94273 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.
- Product
- Snap Finance
- Affected
- up to 3.11.0
- What to do
- Affects up to 3.11.0. Update Snap Finance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2026Salon Booking System: Does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filenameCVE-2026-110033 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
- Product
- Salon Booking System
- Fixed in
- 10.31.11
- What to do
- Update Salon Booking System to 10.31.11 or newer.
Oct 17, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI): Does not perform any capability or ownership check before returning an order's secret key in response to an unCVE-2026-103376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for any paid order and use it to view that order's customer name, email address, postal address and contents.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- Fixed in
- 1.120.70
- What to do
- Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) to 1.120.70 or newer.
Oct 15, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX actionCVE-2026-74920 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
- Product
- Document Gallery
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Responsive Blocks: Does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site ownerCVE-2026-97315 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
- Product
- Responsive Blocks
- Fixed in
- 2.3.0
- What to do
- Update Responsive Blocks to 2.3.0 or newer.
Oct 14, 2026Trust Payments Gateway for WooCommerce: Does not verify the authenticity of the payment provider's responseCVE-2026-87843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.
- Product
- Trust Payments Gateway for WooCommerce
- Fixed in
- 3.1.0
- What to do
- Update Trust Payments Gateway for WooCommerce to 3.1.0 or newer.
Oct 13, 2026Responsive Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-54867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.
- Product
- Responsive Slider
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update Responsive Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Responsive Lightbox & Gallery: Stored Cross-Site ScriptingCVE-2026-103897 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's 'Comments' lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.
- Product
- Responsive Lightbox & Gallery
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Responsive Lightbox & Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2026TutorStarter: Does not respect the site's user registration setting in one of its AJAX registration handlersCVE-2026-104671 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
- Product
- TutorStarter
- Fixed in
- 4.0.4
- What to do
- Update TutorStarter to 4.0.4 or newer.
Oct 3, 2026Responsive Plus – Elementor Templates & Starter Sites: Stored Cross-Site ScriptingCVE-2026-15795 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Responsive Plus – Elementor Templates & Starter Sites
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Responsive Plus – Elementor Templates & Starter Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2026Tabs Responsive: Does not sanitize the content of WooCommerce product tabs before storing and rendering itCVE-2026-13718 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.
- Product
- Tabs Responsive
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Tabs Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026If-So Dynamic Content: Does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is servedCVE-2026-87970 · WordPress plugins & themes · reported by WPScanMedium 4.7
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
- Product
- If-So Dynamic Content
- Fixed in
- 1.10.2
- What to do
- Update If-So Dynamic Content to 1.10.2 or newer.
Sep 30, 2026Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.CVE-2026-94122 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 27, 2026WPeMatico RSS Feed Fetcher: Does not perform a capability check before fetching a user-supplied URL and rendering the responseCVE-2026-89003 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.27
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.27 or newer.
Sep 26, 2026Testimonials Widget: Does not validate a user-supplied URL before fetching it server-side and storing the responseCVE-2026-96533 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
- Product
- Testimonials Widget
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Testimonials Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.CVE-2026-95528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
- Affected
- up to 1.0.31
- What to do
- Affects up to 1.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
- Product
- SUMIT Payment Gateway for WooCommerce
- Fixed in
- 4.0.0
- What to do
- Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Sep 23, 2026Events Calendar: Does not check the post status of linked records before embedding their stored details into a public REST API responseCVE-2026-84741 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 19, 2026LiteSpeed Cache: Reflected Cross-Site ScriptingCVE-2026-76579 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.
- Product
- LiteSpeed Cache
- Affected
- up to 7.9
- What to do
- Affects up to 7.9. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Secure Custom Fields: Does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitorCVE-2026-92403 · WordPress plugins & themes · reported by WPScanLow 3.7
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
- Product
- Secure Custom Fields
- Fixed in
- 6.9.4
- What to do
- Update Secure Custom Fields to 6.9.4 or newer.
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.5
- What to do
- Update Estatik Real Estate to 4.3.5 or newer.
Sep 17, 2026Dictionary: Does not escape user input before reflecting it back in the responses of several directly accessible scriptsCVE-2025-15697 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
- Product
- Dictionary
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dictionary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 12, 2026Frontegg SAML SSO: Does not verify the signature or issuer of SAML authentication responses before establishing a sessionCVE-2026-75800 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Product
- Frontegg SAML SSO
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Frontegg SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026IPGP Visitors Origin: Does not sanitise or escape user input before reflecting it back in the HTTP responseCVE-2026-81404 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.
- Product
- IPGP Visitors Origin
- Fixed in
- 1.6
- What to do
- Update IPGP Visitors Origin to 1.6 or newer.
Sep 3, 2026Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.CVE-2026-84761 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
- Affected
- up to 7.9
- What to do
- Affects up to 7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026FormLayer: Does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handlerCVE-2026-78151 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and integration settings, including those of unpublished forms.
- Product
- FormLayer
- Fixed in
- 1.0.9
- What to do
- Update FormLayer to 1.0.9 or newer.
Sep 1, 2026Photo Gallery by Ays – Responsive Image Gallery: Generic SQL InjectionCVE-2026-76006 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.
- Product
- Photo Gallery by Ays – Responsive Image Gallery
- Affected
- up to 6.8.2
- What to do
- Affects up to 6.8.2. Update Photo Gallery by Ays – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2026geotargetingwp: Does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content typeCVE-2026-14307 · WordPress plugins & themes · reported by WPScanHigh 7.1
The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.
- Product
- geotargetingwp
- Fixed in
- 3.5.6.2
- What to do
- Update geotargetingwp to 3.5.6.2 or newer.
Aug 28, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-3129 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `<img>` tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip `width` and `height` attributes from images when the "Lazy Load Images" and "Add Missing Sizes" features are enabled. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.
- Product
- LiteSpeed Cache
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.litespeedtech.complugins.trac.wordpress.org
Aug 28, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-18978 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. ", <, >) placed inside an allowed element such as <code> bypasses WordPress's wp_kses sanitization, as kses does not treat a data-settings="..." substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.
- Product
- LiteSpeed Cache
- Affected
- up to 7.8.1
- What to do
- Affects up to 7.8.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2026Eventin: Does not restrict access to non-published content by status or ownership in one of its REST API namespacesCVE-2026-13172 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- Product
- Eventin
- Fixed in
- 4.1.22
- What to do
- Update Eventin to 4.1.22 or newer.
Aug 19, 2026SAML Single Sign On: Does not verify the signature of a SAML response before storing the certificate it carriesCVE-2026-19842 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.
- Product
- SAML Single Sign On
- Fixed in
- 5.4.7
- What to do
- Update SAML Single Sign On to 5.4.7 or newer.
Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
- Product
- Link Library
- Fixed in
- 7.9.4
- What to do
- Update Link Library to 7.9.4 or newer.
Aug 6, 2026WP Hotel Booking: Does not verify that a payment notification corresponds to a payment made to the site's own merchant accountCVE-2026-15152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.2
- What to do
- Update WP Hotel Booking to 2.3.2 or newer.
Aug 6, 2026Gutenberg Essential Blocks: Does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the responseCVE-2026-13153 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.
- Product
- Gutenberg Essential Blocks
- Fixed in
- 6.4.0
- What to do
- Update Gutenberg Essential Blocks to 6.4.0 or newer.
Aug 5, 2026Passster: Outputs password-protected block content in the public page response before verifying the passwordCVE-2026-16604 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
- Product
- Passster
- Fixed in
- 4.3.6
- What to do
- Update Passster to 4.3.6 or newer.
Aug 2, 2026King Addons for Elementor: Does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX responseCVE-2026-14841 · WordPress plugins & themes · reported by WPScanMedium 6.1
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.76
- What to do
- Update King Addons for Elementor to 51.1.76 or newer.
Aug 1, 2026Wp Responsive Thumbnail Slider: Reflected Cross-Site ScriptingCVE-2026-18344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Product
- Wp Responsive Thumbnail Slider
- What to do
- Update Wp Responsive Thumbnail Slider to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Dynamic Pricing With Discount Rules for WooCommerce: Does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the responseCVE-2026-13725 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
- Product
- Dynamic Pricing With Discount Rules for WooCommerce
- Fixed in
- 5.0.0
- What to do
- Update Dynamic Pricing With Discount Rules for WooCommerce to 5.0.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.