Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,487 results · page 1 of 30

Oct 29, 2026Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.CVE-2026-61998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.CVE-2026-118084 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
Affected
up to 3.8
What to do
Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.CVE-2026-118081 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-118078 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.CVE-2026-116866 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Product Feed Manager: Missing AuthorizationCVE-2026-118093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
Product
Product Feed Manager
Affected
up to 7.14.1
What to do
Affects up to 7.14.1. Update Product Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026download_remote_file that: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgeryCVE-2026-118989 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Product
download_remote_file that
Fixed in
2.6.8
What to do
Update download_remote_file that to 2.6.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-116409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
Product
Upsell Order Bump Offer for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Upsell Order Bump Offer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-110707 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Recipe Card Blocks Lite: Does not perform an authorization check before rendering posts through its recipe print featureCVE-2026-115282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Product
Recipe Card Blocks Lite
Fixed in
3.6.4
What to do
Update Recipe Card Blocks Lite to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026the update_fees AJAX handler that: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorizationCVE-2026-118757 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Product
the update_fees AJAX handler that
Fixed in
1.1.10.9
What to do
Update the update_fees AJAX handler that to 1.1.10.9 or newer.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026Casso Flow: Does not properly authenticate incoming bank-transfer payment notificationsCVE-2026-103382 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.
Product
Casso Flow
Fixed in
4.2.0
What to do
Update Casso Flow to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 26, 2026Typing Text – Give your texts many typing effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115966 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects: from n/a through 2.2.0.
Product
Typing Text – Give your texts many typing effects
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Typing Text – Give your texts many typing effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2026A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress.CVE-2026-116107 · WordPress plugins & themes · reported by VulDBLow 2.1
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vuldb.com vuldb.com
Oct 24, 2026WP Social Feed Gallery: Missing AuthorizationCVE-2026-114705 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
Product
WP Social Feed Gallery
Affected
up to 5.0.13
What to do
Affects up to 5.0.13. Update WP Social Feed Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2026GeoDirectory: Does not verify that a referenced attachment belongs to the listing being savedCVE-2026-113489 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
Product
GeoDirectory
Fixed in
2.8.194
What to do
Update GeoDirectory to 2.8.194 or newer.
Full record and what to do →NVD record wpscan.com
Oct 24, 2026Download Monitor: Does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the pageCVE-2026-112207 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
Product
Download Monitor
Fixed in
5.3.4
What to do
Update Download Monitor to 5.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Save Life: Deserialization of Untrusted DataCVE-2026-112846 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
Product
Save Life
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Save Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 23, 2026Essential Addons for Elementor: Does not verify that an administrator may manage the specific user accounts targeted by its login-approval featureCVE-2026-110537 · WordPress plugins & themes · reported by WPScanLow 3.8
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Product
Essential Addons for Elementor
Fixed in
6.8.7
What to do
Update Essential Addons for Elementor to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026Royal Elementor Addons: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-111851 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
Product
Royal Elementor Addons
Affected
up to 1.7.1068
What to do
Affects up to 1.7.1068. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Product
MasterStudy LMS
Fixed in
3.7.55
What to do
Update MasterStudy LMS to 3.7.55 or newer.
Full record and what to do →NVD record wpscan.com
Oct 22, 2026MB Custom Post Types & Custom Taxonomies: Does not perform a capability check in its export featureCVE-2026-110011 · WordPress plugins & themes · reported by WPScanLow 2.7
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
Product
MB Custom Post Types & Custom Taxonomies
Fixed in
2.12.3
What to do
Update MB Custom Post Types & Custom Taxonomies to 2.12.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 21, 2026HappyForms: Does not sanitise or escape a user-controlled referral value before embedding it in the form notification emailCVE-2026-14556 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Product
HappyForms
Fixed in
1.26.15
What to do
Update HappyForms to 1.26.15 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 CVE-2026-111862 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record rankmath.com rankmath.com
Oct 19, 2026Surfer: Missing AuthorizationCVE-2026-112222 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
Product
Surfer
Affected
up to 1.8.0.744
What to do
Affects up to 1.8.0.744. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2026Salon Booking System: Does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filenameCVE-2026-110033 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
Product
Salon Booking System
Fixed in
10.31.11
What to do
Update Salon Booking System to 10.31.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 17, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-92715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Insecure Direct Object ReferenceCVE-2026-107762 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.3.2
What to do
Affects up to 6.3.2. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026WPeMatico RSS Feed Fetcher: Stored Cross-Site ScriptingCVE-2026-110252 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.
Product
WPeMatico RSS Feed Fetcher
Affected
up to 2.9
What to do
Affects up to 2.9. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026HUSKY – Products Filter for WooCommerce Professional: Sensitive Information ExposureCVE-2026-107646 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
Product
HUSKY – Products Filter for WooCommerce Professional
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update HUSKY – Products Filter for WooCommerce Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler: Insecure Direct Object ReferenceCVE-2026-103525 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read and exfiltrate another customer's stored billing and shipping address PII — including street address, city, state, postcode, phone number, company name, VAT number, and legal registration ID — by enumerating sequential AUTO_INCREMENT order and address ID pairs. The id-equality guard intended to restrict address reuse is bypassed because the attacker controls both halves of the compared pair, and the unauthenticated AJAX entry point imposes only a soft rate limit of 5 requests per 60 seconds rather than any authentication or ownership check.
Product
FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Insecure Direct Object ReferenceCVE-2026-89280 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to change the WordPress account password of any customer who has placed at least one order with the attacking vendor, enabling login as that customer and resulting in a limited account takeover. Vendor-level access, required to exploit this vulnerability, can be self-registered through the public 'I am a vendor' registration flow when that option is enabled on the site.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-109207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.2.11
What to do
Affects up to 5.2.11. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026Blog2Social – Social Media Auto Post & Scheduler: Insecure Direct Object ReferenceCVE-2026-108092 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-object authorization on the postId parameter. This makes it possible for authenticated attackers with Contributor-level access and above to read the title and content of any post, including private and pending posts belonging to other users.
Product
Blog2Social – Social Media Auto Post & Scheduler
Affected
up to 9.1.4
What to do
Affects up to 9.1.4. Update Blog2Social – Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
Product
WPCode
Fixed in
2.4.0
What to do
Update WPCode to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object ReferenceCVE-2026-103366 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant: Does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposeCVE-2026-87968 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Product
Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
Fixed in
5.3.2
What to do
Update Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026FV Flowplayer Video Player: Does not properly validate a user-supplied URL before performing a server-side fetchCVE-2026-85345 · WordPress plugins & themes · reported by WPScanMedium 4.1
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
Product
FV Flowplayer Video Player
Fixed in
7.5.55.7212
What to do
Update FV Flowplayer Video Player to 7.5.55.7212 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlCVE-2026-105261 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
Product
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
Fixed in
4.10.6
What to do
Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to 4.10.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 13, 2026Snazzy Social Media Feed: Arbitrary File UploadCVE-2026-110002 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The save-to-cache.php script is directly reachable without loading WordPress; FILTER_SANITIZE_URL — the only filter applied to the pluginURL value — preserves the characters required to craft a valid PHP payload, which is then written verbatim into cached-content/cached-feed.php and immediately executable via a single GET request.
Product
Snazzy Social Media Feed
Affected
up to 2.5
What to do
Affects up to 2.5. Update Snazzy Social Media Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2026Envira Gallery: Does not correctly check authorization on its gallery-conversion featureCVE-2026-104682 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
Product
Envira Gallery
Fixed in
1.16.2
What to do
Update Envira Gallery to 1.16.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · WordPress plugins & themes · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
Product
Envira Gallery
Fixed in
1.16.2
What to do
Update Envira Gallery to 1.16.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.CVE-2026-62096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.CVE-2026-62095 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 10, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Insecure Direct Object ReferenceCVE-2026-93746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026CV Builder – Professional Resume Builder SaaS: Unauthorized arbitrary file uploadCVE-2026-3717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
Product
CV Builder – Professional Resume Builder SaaS
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update CV Builder – Professional Resume Builder SaaS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object Reference / Missing AuthorizationCVE-2026-91050 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the code flow explicitly removes the customer and payment steps when this is truthy (the source even carries a TODO acknowledging the missing validation). This makes it possible for unauthenticated attackers to create approved appointments against other customers' order items and to read those customers' names, email addresses, and order codes returned in the booking confirmation.
Product
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2026Rank Math SEO: Does not correctly validate the type of a file uploaded through its settings import featureCVE-2026-104752 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
Product
Rank Math SEO
Fixed in
1.0.280
What to do
Update Rank Math SEO to 1.0.280 or newer.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026AI Puffer – Chat. Create. Automate. (formerly AI Power): Authorization bypassCVE-2026-104742 · WordPress plugins & themes · reported by WordfenceLow 3.1
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that an administrator has previously granted the Knowledge Base ('sources') module to the attacker's role via the Role Manager, as this access is not available to lower-privileged users by default.
Product
AI Puffer – Chat. Create. Automate. (formerly AI Power)
Affected
up to 2.4.89
What to do
Affects up to 2.4.89. Update AI Puffer – Chat. Create. Automate. (formerly AI Power) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.