Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

23,771 results · page 1 of 476

Oct 31, 2026Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News: Stored Cross-Site ScriptingCVE-2026-119160 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown — a standard filter interaction requiring no elevated privileges from the victim.
Product
Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights): Sensitive Information ExposureCVE-2026-109367 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers to extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.
Product
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Booking for Appointments and Events Calendar – Amelia: Sensitive Information ExposureCVE-2026-103915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 2.4.12
What to do
Affects up to 2.4.12. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-120070 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role="editor"]` shortcode into a published p
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: Sensitive Information ExposureCVE-2026-110023 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
Product
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected
up to 5.5.88
What to do
Affects up to 5.5.88. Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnCVE-2026-103962 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check on the wpuf_get_child_cat AJAX action is not an effective security barrier because the wpuf_nonce value is publicly localized to every anonymous visitor of any page containing a WPUF shortcode, making it freely harvestable by an unauthenticated attacker.
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Seraphinite Accelerator: Sensitive Information ExposureCVE-2026-90960 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Product
Seraphinite Accelerator
Affected
up to 2.29.24
What to do
Affects up to 2.29.24. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Mail logging & Catcher: Sensitive Information ExposureCVE-2026-120040 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.
Product
Mail logging & Catcher
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Mail logging & Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 31, 2026User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored DOM-Based Cross-Site ScriptingCVE-2026-119162 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On a default installation the submitted post is held as Pending and requires admin approval before the payload is reachable by other visitors; however, if the plugin's "publish immediately" option is enabled, no approval step exists and the stored payload becomes live without any moderator interaction.
Product
User Submitted Posts – Enable Users to Submit Posts from the Front End
Affected
up to 20260916
What to do
Affects up to 20260916. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026PDF Invoices & Packing Slips for WooCommerce: Sensitive Information ExposureCVE-2026-109217 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.16.5 via the 'invoice_number (via document filename)' parameter. This makes it possible for unauthenticated attackers to extract another customer's complete invoice PDF — including billing identity, shipping address, private order notes, line items, prices, dates, order ID, and invoice number — delivered directly to the attacker's email as an order confirmation attachment. Exploitation requires the plugin's yearly invoice number reset option to be enabled, and the attacker's guest-checkout order must trigger a processing email within 60 seconds of a victim order that shares the same yearly-reset invoice number.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.16.5
What to do
Affects up to 5.16.5. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2026Quick Event Manager: Does not verify the status or type of the requested post before returning its details through a calendar exportCVE-2026-82214 · WordPress plugins & themes · reported by WPScan
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.
Product
Quick Event Manager
Fixed in
9.19
What to do
Update Quick Event Manager to 9.19 or newer.
Full record and what to do →NVD record wpscan.com
Oct 31, 2026Mapster WP Maps: Does not perform any authorization check on a REST API route that writes post dataCVE-2026-118638 · WordPress plugins & themes · reported by WPScan
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.
Product
Mapster WP Maps
Fixed in
2.0.6
What to do
Update Mapster WP Maps to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 30, 2026The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query paramCVE-2026-110176 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.7
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Product
File Force Download
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record d7es.tag1.com herodevs.com
Oct 30, 2026Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.CVE-2026-116861 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2026Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.CVE-2026-115947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 30, 2026Advanced Custom Fields: Extended: Sensitive Information ExposureCVE-2026-110305 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. Exploitation requires that an administrator has configured a public [acfe_form] shortcode page with a Term action using a save.name field mapping — a supported and documented configuration.
Product
Advanced Custom Fields: Extended
Affected
up to 0.9.2.7
What to do
Affects up to 0.9.2.7. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2026DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.CVE-2026-61789 · Other software · bytebase · reported by GitHubMedium 6.1
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual
Product
dbhub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2026In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted applicatiCVE-2026-115642 · Other software · OpenStack · reported by MITREHigh 8.3
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.
Product
keystonemiddleware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net github.com
Oct 30, 2026Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URCVE-2026-119709 · Other software · goniszewski · reported by VulnCheckMedium 6.9
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.
Product
grimoire
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2026An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpointCVE-2026-117184 · Other software · reported by MITRE
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2026ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDBCVE-2026-119577 · Other software · ArcadeData · reported by VulnCheckHigh 7.6
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.
Product
arcadedb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 30, 2026FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote CVE-2026-112374 · Other software · FOSSBilling · reported by VulnCheckMedium 5.1
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
Product
FOSSBilling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2026Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownCVE-2026-119564 · Other software · Plausible · reported by VulnCheckMedium 6
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
Product
Plausible Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting tCVE-2026-119429 · Websites & servers · phpMyAdmin · reported by VulnCheckMedium 5.3
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix opeCVE-2026-119376 · Other software · SQLite · reported by VulnCheckMedium 6.8
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026The web server does not check authentication on POST or PUT.CVE-2026-22110 · Other software · Delta Electronics · reported by csirt@divd.nlHigh 8.7
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Product
Delta UFC500
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Oct 30, 2026Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number.CVE-2026-22105 · Other software · Delta Electronics · reported by csirt@divd.nlHigh 8.7
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
Product
Delta UFC500
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Oct 30, 2026Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest apCVE-2026-59388 · Other software · Cloud Foundry Foundation · reported by security@vmware.comMedium 6.5
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
Product
CAPI (Cloud Foundry Controller)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloudfoundry.org
Oct 30, 2026Page and Post Restriction: Authentication BypassCVE-2026-118194 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request `Origin` and sets `Access-Control-Allow-Credentials: true` — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via `/wp-json/wp/v2/users/me`, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin `fetch` requests against the target site's REST API; no non
Product
Page and Post Restriction
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Page and Post Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2026BuddyForms: Does not verify that a user editing an existing entry is the author of the target postCVE-2026-118101 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
Product
BuddyForms
Fixed in
2.10.1
What to do
Update BuddyForms to 2.10.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 30, 2026Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118544 · Websites & servers · Drupal · reported by mlhess@drupal.org
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 29, 2026Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administratiCVE-2026-90867 · Other software · Progress Software · reported by security@progress.comHigh 8.1
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Product
WS_FTP Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record progress.lightning.force.com
Oct 29, 2026Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who coulCVE-2026-90861 · Other software · Progress Software · reported by security@progress.comMedium 6.6
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
Product
WS_FTP Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record progress.lightning.force.com
Oct 29, 2026Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI.CVE-2026-66912 · Email & office · Synacor · reported by cvd@cert.plMedium 5.3
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21
Product
Zimbra Collaboration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl wiki.zimbra.com
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.CVE-2026-54864 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
Affected
up to 1.165
What to do
Affects up to 1.165. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.CVE-2026-118083 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.CVE-2026-116869 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026Broken Function Level Authorization allows execution of poller post-restart commands by authenticated userCVE-2025-13050 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7Medium 5.4
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com thewatch.centreon.comundefined
Oct 29, 2026PDF Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48195 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
Product
PDF Poster
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update PDF Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/CVE-2026-119049 · Other software · idinging · reported by VulnCheckHigh 7.2
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
Product
FreeMail
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenCVE-2026-113693 · Other software · BMC · reported by 47237f96-ddbe-4467-a5ee-293a770beacdMedium 5.3
Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
Product
BMC IT Service Management Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.helixops.ai docs.helixops.ai
Oct 29, 2026The Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-56056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
Product
The Post Grid
Affected
up to 7.9.7
What to do
Affects up to 7.9.7. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2026MW WP Form: Sensitive Information ExposureCVE-2026-92086 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.
Product
MW WP Form
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update MW WP Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 29, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Sensitive Information ExposureCVE-2026-91153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 29, 2026A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information.CVE-2026-111419 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.6
A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials.
Product
foxit.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxit.com
Oct 29, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-110707 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.2.12
What to do
Affects up to 5.2.12. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 29, 2026Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.CVE-2026-118905 · Other software · nvm-sh · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158High 7.1
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)
Product
nvm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026Recipe Card Blocks Lite: Does not perform an authorization check before rendering posts through its recipe print featureCVE-2026-115282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Product
Recipe Card Blocks Lite
Fixed in
3.6.4
What to do
Update Recipe Card Blocks Lite to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026GeoDirectory: Does not honour post password protectionCVE-2026-114270 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
Product
GeoDirectory
Fixed in
2.8.197
What to do
Update GeoDirectory to 2.8.197 or newer.
Full record and what to do →NVD record wpscan.com
Oct 29, 2026WP Post Author: Does not restrict the integration settings it returns to visitorsCVE-2026-108686 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
Product
WP Post Author
Fixed in
4.2.0
What to do
Update WP Post Author to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.