Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
Wordfence's weekly report for October 5–11, 2026, added 655 vulnerabilities across 406 plugins and 100 themes, with contributions from 236 researchers. Of these, 21 were critical, 249 high, 377 medium, and 8 low; 366 were patched and 289 remained unpatched. Highlighted issues include unauthenticated stored cross-site scripting in WordPress Core 7.1 through 7.1.2 via pending comments, and unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce 10.8.0 and earlier. Premium firewall rules were deployed immediately, while free Wordfence users receive them after 30 days.
655 flaws added across 406 plugins and 100 themes.
Full article2,679 words · extracted from wordfence.com · click to collapse
HAVE YOU BEEN HACKED?GET HELP
CREATE ACCOUNT
SIGN IN
PRODUCTS
INTELLIGENCE
SUPPORT
NEWS
ABOUT
VIEW PRICING
Chloe Chamberland
October 15, 2026
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
WordPress Core 7.1 – 7.1.2 – Unauthenticated Stored Cross-Site Scripting via Pending Comments
Abandoned Cart Pro for WooCommerce <= 10.8.0 – Unauthenticated SQL Injection via Guest Persistent Cart meta_value
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
Patch Status Number of Vulnerabilities
Patched 366
Unpatched 289
Total Vulnerabilities by CVSS Severity Last Week
Severity Rating Number of Vulnerabilities
Low Severity 8
Medium Severity 377
High Severity 249
Critical Severity 21
Total Vulnerabilities by CWE Type Last Week
Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 198
Missing Authorization 112
Deserialization of Untrusted Data 67
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 61
Exposure of Sensitive Information to an Unauthorized Actor 45
Improper Privilege Management 30
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 24
Authorization Bypass Through User-Controlled Key 21
Unrestricted Upload of File with Dangerous Type 18
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 15
Improper Control of Generation of Code ('Code Injection') 11
Improper Authentication 9
Cross-Site Request Forgery (CSRF) 8
Client-Side Enforcement of Server-Side Security 7
Incorrect Authorization 6
Server-Side Request Forgery (SSRF) 5
Missing Authentication for Critical Function 3
Uncontrolled Resource Consumption 3
Authentication Bypass Using an Alternate Path or Channel 2
Protection Mechanism Failure 2
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') 1
Files or Directories Accessible to External Parties 1
Improper Authorization 1
Improper Input Validation 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 1
Insertion of Sensitive Information Into Sent Data 1
Loop with Unreachable Exit Condition ('Infinite Loop') 1
Use of Cache Containing Sensitive Information 1
Researchers That Contributed to WordPress Security Last Week
Researcher Name Number of Vulnerabilities
Ananda Dhakal
61
João Pedro S Alcântara
42
Bonds
26
Wordfence PRISM
26
Naoki Kawahigashi
19
Tran Nguyen Bao Khanh
18
Intrudify
16
Enrico Marcolini
16
johska
15
Peter Tang
13
Karthik Ramakrishnan
12
Rafie Muhammad
10
Jamaal ahmed
8
Pablo González Pérez
7
Francisco José Ramírez Vicente
7
Iñigo Sánchez Enciso
7
Erwan LR
7
dutafi
7
nh4tvd
6
Yaswanth Reddy Sunkara
6
Raphael P. Cigana
6
neurotx
6
ParkHyunWoo
6
Asim Alshaya
6
daroo
6
V1T
5
Supakiad S. (m3ez)
5
Jakub Herman
5
JunHee CHO
5
Ryan Fabella
4
Kuba
4
Morato Antoine
4
Nguyen Ba Khanh
4
Usama Arshad
4
Aydan Arabadzha
4
Adrien Brunner
4
d.v4n_s3c
4
John Ryan Albon
4
Muni Nitish Kumar Yaddala
4
Pedro Pinho
3
crow
3
zickzick2
3
Jacek Sowiński (dzaku)
3
Claudio Marchesini
3
Dottor Marc
3
Philipp Doblhofer
3
dodoh4t
3
Deva Parekh
3
João Ramos Maciel
3
Ayukiab
3
Anthropic
3
theviper17y
3
hhhai
2
Ratchanon Chamnankit
2
Tarcísio Luchesi De Almeida Silva (Poystick)
2
Daniel Dhaniswara
2
Tai Ha (superx)
2
Erik Debye
2
vuxvinh
2
Omar Elshopky (3l5h0pky)
2
elaprendiz1927
2
0xd4rk5id3
2
Nixxies
2
b1ue0cean
2
Osman Hussein
2
sungbyeongchan
2
Rik de Kok
2
dcs
2
Tarcísio Luchesi
2
Joshua Martinelle
2
Rasyid Abdi Gantoro
2
Mohammed Abd Alrahman
2
dzeusking
2
Theo Fonseca
2
Sawyer
2
she11f
2
achmad sonif
2
Ivaylo
2
Lee chul woong
2
Wordfence Argus
2
RIA Labs
2
Artus KG
2
Stefan Löwen
2
Coopernicus
2
Maciej Komorowski
2
takito
2
Filip Kowalski
2
Webbernaut
2
Nguyen Dinh Hai (HaiND)
2
Andy Urlep
1
Olaf Schigt
1
Abdullah Kareem "cyberkareem"
1
Supakiad S.
1
Que Thanh Tuan
1
Utkarsh Choudhary
1
Nadir Şensoy
1
0xzenko
1
braintx
1
Kamil B.
1
Alexander Jurkschat
1
mamgad
1
lhking
1
Aliou Cisse (KevineCharles)
1
blast
1
benzdeus
1
Jonah Burgess (CryptoCat)
1
Ayoub MOUHATTA
1
Shikhali Jamalzade
1
Suhayb Ahmed
1
Aarush Gaur
1
ShinThink
1
Je22y
1
Quentin VILLAIN
1
KePulsary
1
Ala Bouali
1
nguyen viet tin
1
Hippolyte Quéré (Hippie) (Hippie)
1
buitu
1
Raúl Conesa
1
Sanyam Jain
1
UKO
1
luffy
1
mamgad
1
Dahmani Toumi
1
Masaya Morita
1
Seongwon Lee
1
Doston Abdullayev
1
Krugov Artyom
1
George Chen
1
Thomas Chauchefoin
1
Guntur Wahyu Ramadhan
1
Santh
1
etomixer
1
Mohamed Bassia
1
yzx001
1
Paul Serban
1
Claude Ndanda
1
Kenneth Billones
1
K. Sorrachat
1
Muni Nitish Kumar Yaddala (Stranger825)
1
wachirapong kamphapong (wachiss)
1
LevinityCyber
1
Duy Tran
1
Trithem
1
Dthangws
1
L4m
1
whatm
1
t4g0
1
Aurélien BOURDOIS
1
Md. Moniruzzaman Prodhan
1
normaandersonfrank
1
Thaer Assfour
1
Zhengyu Liu
1
Jingcheng Yang
1
Gavin Zhong
1
Boluwatife Opeyemi (tcyph3r)
1
Bhaveshkumar Parmar
1
Spy0x7
1
Sebastian Albrecht (mySebbe)
1
emiliano carrizo
1
owlmind
1
duna
1
Muhammad Yudha
1
HOMEVO Adonis Orfel
1
Oly Hossen
1
Zac Lou
1
Alex Thomas
1
Salúa Es-sair
1
Athiwat Tiprasaharn (Jitlada)
1
刀 妖
1
c4st1e
1
Md. Minaruzzaman Shovon
1
nthng
1
Tawatchai Pinsuwan
1
Kitch
1
Bao
1
T.Kalimullin
1
fcc
1
Muhammad Yudha - DJ
1
Muhammad Sobirov
1
Stefan Spasic
1
changsheng
1
sahinyes
1
Mytears
1
Timur Jurayev
1
Raj Ukani
1
Dustin Lange
1
Sarthak Saxena
1
zaim
1
awhacken
1
Teerachai Somprasong
1
hackthesoul
1
Thanh Hang
1
shark3y
1
William Honnér
1
Hiro
1
HunterSploit
1
Ayush Srivastava
1
Filip Kecman
1
Akbarov Rauf
1
20kilograma
1
Rafael Honorato
1
Jonathan Dersch
1
Taylsec
1
Muhamad Visat
1
Nguyen Kim Sang
1
Khaled Alenazi
1
uhcna
1
wackydawg
1
Brian Mungai
1
Alex Concha
1
Phat RiO | João Pedro S Alcântara
1
Enis Getmez
1
Averon Averenkov
1
Akshat Parikh
1
ieuns
1
endy
1
R3D
1
Chloe Chamberland
1
cazy
1
Pedro "TheZakMan" Araujo
1
Zenith-sec
1
Het Kalariya
1
Matthew Lapinski
1
stealthcopter
1
skyv3il
1
AmonRa
1
Yuvraj Tomar
1
Michał Wiencek
1
Vũ Quang Huy
1
Ismayil Tahmazov
1
Zein
1
myhappyhoon
1
Mike Gozdiskowski
1
jydae
1
longnv719
1
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
Software Name Software Slug
10Web Booster – Website speed optimization, Cache & Page Speed optimizer tenweb-speed-optimizer
10WebSocial wd-instagram-feed
3D Product configurator for WooCommerce expivi
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder ablocks
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning academy
Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension
ACPT (Premium) advanced-custom-post-type
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing
Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce
Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro
Advanced Form Integration — Connect Forms to 300+ Apps advanced-form-integration
Advanced Google reCAPTCHA advanced-google-recaptcha
Advanced IP Blocker advanced-ip-blocker
Advanced Posts Listing – Show Post List Easily advanced-posts-listing
Adwised Web Push Notification adwised
AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display affiliate-toolkit-starter
AI Content Generator Marketing ai-content-generator-marketing
AI Copilot – Content Generator ai-copilot-content-generator
AI Puffer – MCP, AI Chatbot & Content Automation gpt3-ai-content-generator
Airwallex Online Payments Gateway airwallex-online-payments-gateway
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship
All Bootstrap Blocks all-bootstrap-blocks
Animated Number Counters animated-number-counters
Ansar Import – One Click Starter Sites – for WordPress Themes ansar-import
Anton Extensions 4nton-extensions
App for Cloudflare® app-for-cf
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Bookings for Zoom GoogleMeet and more – Wappointment wappointment
ARforms arforms
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember
Asgaros Forum asgaros-forum
ASPL Product Quotation aspl-product-quotation
Aurora Heatmap aurora-heatmap
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI automatorwp
AutoPoly – AI Translation For Polylang automatic-translations-for-polylang
Autoship Cloud for WooCommerce Subscription Products autoship-cloud
Avada (Fusion) Builder fusion-builder
AWP Classifieds another-wordpress-classifieds-plugin
BackWPup – WordPress Backup & Restore Plugin backwpup
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Bayarcash WooCommerce bayarcash-wc
bBlocks – Essential Gutenberg Blocks & Patterns Collection b-blocks
Before After Image Comparison – Visual Comparison for Two Images before-after-image-compare
Blocksy Companion blocksy-companion
Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor
Booking Calendar booking
Booking Package booking-package
Booknetic booknetic
Booktics – Appointment Booking Calendar for Service Businesses booktics
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools woocommerce-jetpack
Bricksforge bricksforge
Brizy – Page Builder brizy
BuddyBoss Platform buddyboss-platform
BuddyPress Instant Chat bp-instant-chat
Builderius – Landing Page Builder + Dynamic Templates builderius
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms captcha-bws
CF7 Views – Complete Entry Management for Contact Form 7 cf7-views
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) charitable
Church Admin church-admin
click5 CRM add-on to Contact Form 7 cf7-add-on-by-click5
click5 CRM add-on to Gravity Forms gf-add-on-by-click5
click5 CRM add-on to Ninja Forms click5-crm-add-on-to-ninja-forms
click5 CRM add-on to WPForms wpf-add-on-by-click5
Code Snippets code-snippets
CodeBard Help Desk codebard-help-desk
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db
Content Visibility for Divi Builder content-visibility-for-divi-builder
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
CP Media Player – Audio Player and Video Player audio-and-video-player
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators creatorlms
Crowdfundly crowdfundly
CURCY – Multi Currency for WooCommerce woo-multi-currency
Dashboard Notes dashboard-notes
Data Tables Generator by Supsystic data-tables-generator-by-supsystic
Database Addon For WPForms ( wpforms entries ) – WPFormsDB database-for-wpforms
Database for CF7 database-for-cf7
Datalist it datalistit
Directory Listings WordPress plugin – uListing ulisting
DirectoryPress – Business Directory And Classified Ad Listing directorypress
Disable Users disable-users
Divi Plus divi-plus
Doctreat Core doctreat_core
Document Embedder – let visitors read files without downloading document-emberdder
Document Gallery document-gallery
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
Download Manager download-manager
DTX – Dynamic Text Extension for Contact Form 7 contact-form-7-dynamic-text-extension
Dynamic User Directory dynamic-user-directory
E-cab Taxi Booking Manager for Woocommerce ecab-taxi-booking-manager
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
eCommerce Product Catalog ecommerce-product-catalog
Edwiser Bridge – WordPress Moodle Integration edwiser-bridge
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons bdthemes-element-pack-lite
ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) elex-bulk-edit-products-prices-attributes-for-woocommerce-basic
Email Marketing for WordPress and WooCommerce – Retainful retainful
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files embed-any-document
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More envira-gallery-lite
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams eroom-zoom-meetings-webinar
Event Tickets and Registration event-tickets
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution
Events Manager – Calendar, Bookings, Tickets, Appointments and more! events-manager
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) extensions-for-cf7
Fastcache by Host.it fastcache-by-host-it
Favicon Rotator favicon-rotator
Filter Everything — WordPress & WooCommerce Filters filter-everything
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment firebox
Fluent Affiliate Pro fluent-affiliate-pro
Fluent Booking Pro fluent-booking-pro
Fluent Forms Pro Add On Pack fluentformpro
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform
Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu
FooSales – Point of Sale (POS) for WooCommerce foosales
Form Block form-block
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Freeton WP freeton-wp
Front End PM front-end-pm
Frontend Admin by DynamiApps acf-frontend-form-element
Frontend Dashboard frontend-dashboard
Fundiin cho WooCommerce fundiin
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout funnel-builder
FV Flowplayer Video Player fv-wordpress-flowplayer
FV Player 8 fv-player
Gallery PhotoBlocks photoblocks-grid-gallery
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress
GDPR Data Request Form gdpr-data-request-form
Geliver Akıllı Kargo Pazaryeri geliver-akilli-kargo-pazaryeri
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
Getwid – Gutenberg Blocks getwid
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
GiveWP – Donation Plugin and Fundraising Platform give
Gloria Admin Panel gloria-admin-panel
Gmedia Photo Gallery grand-media
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI gptranslate
Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates happy-elementor-addons
Hello Plus hello-plus
HireZoot – Job Listings, Career Page & Recruitment Tool wp-job-openings
HivePress – Business Directory, Listings & Classified Ads Plugin hivepress
HollerBox — Fast & Effective Popups & Lead-Generation holler-box
HootBoard – Bulletin Board For Your Organization & Team Communication hootboard
Hotel Booking nd-booking
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player html5-audio-player
HTTP Requests Manager http-requests-manager
Hustle – Email Marketing, Lead Generation, Optins, Popups wordpress-popup
If-So Dynamic Content – Elementor & All Page Builders Personalization if-so
Image Optimizer, Resizer and CDN – Sirv sirv
Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite
Image Slider image-slider-widget
Import and export users and customers import-users-from-csv-with-meta
Instapage Plugin instapage
Insurify – Order & Shipping Protection insurify
Integration for Epos Now and WooCommerce woo-epos-now-integration
JetBlocks for Elementor jet-blocks
JetElements jet-elements
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
Jetpack VideoPress jetpack-videopress
Jetpack – WP Security, Backup, Speed, & Growth jetpack
Job Postings job-postings
Jotform – AI Chatbot jotform-ai-chatbot
JS Help Desk – AI-Powered Support & Ticketing System js-support-ticket
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
KeyWord Collector keyword-collector
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce
Koinonia Link koinonia-link
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes rocket-lazy-load
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
Leyka leyka
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes lifterlms
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
ListingPro Plugin listingpro-plugin
Livees Checkout livees-checkout
Llavero.io llavero-io
Login Lockdown & Protection login-lockdown
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery logo-showcase
Loja Automática loja-automatica
LTL Freight Quotes – ODFL Edition ltl-freight-quotes-odfl-edition
Magee Shortcodes magee-shortcodes
Mailjet Email Marketing mailjet-for-wordpress
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites mainwp-child
Mapster WP Maps mapster-wp-maps
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
Media Library Assistant media-library-assistant
Memberful – Membership Plugin memberful-wp
MemberHero – Simple User Registration & Login wp-registration
Meta Box AIO meta-box-aio
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet paid-membership
Midtrans-WooCommerce midtrans-woocommerce
Mindstien Quick Login mindstien-quick-login
miniOrange OTP Login, Verification and SMS Notifications miniorange-otp-verification
Mobile builder mobile-builder
Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress molongui-authorship
Morning for WooCommerce wc-gateway-greeninvoice
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar mp3-music-player-by-sonaar
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO multiple-pages-generator-by-porthas
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Museder RestoreOne museder-restoreone
Music Store – WordPress eCommerce music-store
Name Directory name-directory
Newsletter Subscription Form – User Subscriptions Form, Capture Email newsletter-subscription-form
Nexi XPay Build nexi-xpay-build
Noptin – Newsletter, New Post Notifications & Email Automation newsletter-optin-box
Norvis Backup norvis-backup
Ocean eComm Treasure Box ocean-ecommerce
Ocean Pro Demos ocean-pro-demos
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. host-webfonts-local
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Order Export & Order Import for WooCommerce order-import-export-for-woocommerce
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway cryptocurrency-payments-using-metamask-for-woocommerce
payever – WooCommerce Gateway payever-woocommerce-gateway
paymendo – Bank Transfer (Lite) paymendo-bank-transfer
Payment Plugins for Stripe WooCommerce woo-stripe-payment
PayPlug for WooCommerce (Official) payplug
PDF Invoices & Packing Slips for WooCommerce – Challan webappick-pdf-invoice-for-woocommerce
peepso peepso
PeproDev Ultimate Profile Solutions peprodev-ups
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Reviews for WooCommerce woo-photo-reviews
picu – Online Photo Proofing Gallery picu
Piotnet Addons For Elementor piotnet-addons-for-elementor
Piotnet Forms piotnetforms
Pix por Piggly (para Woocommerce) pix-por-piggly
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Polylang polylang
Portfolio Filter Gallery – Photo Gallery portfolio-filter-gallery
Porto Theme - Functionality porto-functionality
Post Export Import with Media post-export-import-with-media
Post Grid Gutenberg Blocks – PostX ultimate-post
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App post-smtp
Post Snippets – Custom WordPress Code Snippets Customizer post-snippets
Post title marquee scroll post-title-marquee-scroll
Post Voting System post-voting-system
PowerPress Podcasting plugin by Blubrry powerpress
PPOM – Product Addons & Custom Fields for WooCommerce woocommerce-product-addon
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates premium-addons-for-elementor
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Prenotazioni prenotazioni
Presto Player presto-player
Presto Player Pro presto-player-pro
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons bdthemes-prime-slider-lite
Product Configurator for WooCommerce product-configurator-for-woocommerce
Product Designer for WooCommerce WordPress | Lumise lumise
Pubjet | پابجت pubjet
QA Assistants – Driven by data qa-heatmap-analytics
Qode Music qode-music
Qode Real Estate qode-real-estate
Qode Tours qode-tours
QR Redirector qr-redirector
Quick quotes – WPSHARE247 quick-quotes-wpshare247
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next
Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events radius-booking
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Real Estate Manager – Property Listing and Agent Management real-estate-manager
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder real3d-flipbook-lite
Recordbrowser recordbrowser
Redux Framework redux-framework
Responsive Lightbox & Gallery responsive-lightbox
Restrict User Access – Ultimate Membership & Content Protection restrict-user-access
Robo Gallery – Photo & Image Slider robo-gallery
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator feedzy-rss-feeds
rtMedia for WordPress, BuddyPress and bbPress buddypress-media
SafeSnap – Verified WordPress Backup & Restore safesnap
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas salon-booking-system
Scripts n Styles scripts-n-styles
Sell Downloads sell-downloads
SendPress Newsletters sendpress
Shipping for Nova Poshta nova-poshta-ttn
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Simple File List simple-file-list
Simple JWT Login – Allows you to use JWT on REST endpoints. simple-jwt-login
Simple Membership simple-membership
Simply Schedule Appointments simply-schedule-appointments
Site Setup Wizard site-setup-wizard
Sitemovr sitemovr
SiteOrigin Widgets Bundle so-widgets-bundle
SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration
SKU Error Fixer for WooCommerce sku-error-fixer-for-woocommerce
Slider by 10Web – Responsive Image Slider slider-wd
Smart Popup by Supsystic popup-by-supsystic
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery sms-alert
SmugMug Embed smugmug-embed
Snapshotify – All-in-One Backup & Restore & Migrate snapshotify
Social Rocket – Social Sharing Plugin social-rocket
Social Share Icons & Social Share Buttons ultimate-social-media-plus
Social Web Suite – Social Media Auto Post, Social Media Auto Publish social-web-suite
Spam Protection for Forms & Comments. Anti-Spam by CleanTalk cleantalk-spam-protect
SpeedyCache – Cache, Optimization, Performance speedycache
Squadeno – Club Sports Manager squadeno-club-sports-manager
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg astra-sites
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce storegrowth-sales-booster
StreamCast – bring live radio to your site with a sleek player streamcast
String locator string-locator
Subscribe to Comments subscribe-to-comments
Super Forms – Drag & Drop Form Builder super-forms
Super Payments – WooCommerce Payment Gateway super-payments
Super Video player – Fully Customizable Video Player with Playlist super-video-player
SureDash – Community, Courses & Member Dashboard suredash
Swish Migrate and Backup swish-migrate-and-backup
Table Field Add-on for ACF and SCF advanced-custom-fields-table-field
Tabs Responsive – With WooCommerce Product Tabs Extension tabs-responsive
Tailored Tools tailored-tools
Tainacan tainacan
Taskbot taskbot
Tcard WP tcard-wp
Team Section Block – Showcase Team Members with Layout Options team-section
Team – Team Members Showcase Plugin tlp-team
Testimonials by BestWebSoft bws-testimonials
Thanko Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer
The GDPR Framework By Data443 gdpr-framework
ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras
Tickera – Sell Tickets & Manage Events tickera-event-ticketing-system
Tonda Membership tonda-membership
Topcontent topcontent
Tourfic Pro tourfic-pro
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping track-orders-for-woocommerce
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Tutor LMS – eLearning and online course solution tutor
uDesign | Multipurpose WordPress Theme u-design-core
Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform ultimate-multisite
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets ultimate-post-kit
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included uncanny-automator
UnitechPay – Wave & Orange Money Payments unitechpay-paiements-mobile-money
Unlimited Elements for Elementor unlimited-elements-for-elementor
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration upcasted-s3-offload
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission wp-user-frontend
User Private Files – Secure File Sharing and Client Portal Plugin user-private-files
Veeqo for WooCommerce veeqo-for-woocommerce
Video Background Block – Add Stunning Video Backgrounds to Any Section video-background-block
Video Conferencing with Zoom video-conferencing-with-zoom-api
VikBooking Hotel Booking Engine & PMS vikbooking
VikRentCar Car Rental Management System vikrentcar
VillaTheme Core villatheme-core
Visual Composer Website Builder visualcomposer
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
W3 Total Cache w3-total-cache
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments wallet-system-for-woocommerce
WC Fields Factory wc-fields-factory
WCFM – Multivendor Marketplace REST API for WooCommerce wcfm-marketplace-rest-api
Web Plura Backup & Restore – Local Backups, Restore & Recovery web-plura-backup-restore-manager
Web Vitals Tracking web-vitals-tracking
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels print-invoices-packing-slip-labels-for-woocommerce
WeddingCity Lite – Wedding Directory and Listing weddingcity-lite
Wise Chat wise-chat
WooCommerce woocommerce
WooCommerce Bookings woocommerce-bookings
WooCommerce Simple Auctions woocommerce-simple-auctions
Wordable – Export Google Docs to WordPress wordable
Workreap Core workreap_core
WP 2FA – Two-factor authentication for WordPress wp-2fa
WP Admin Audit wp-admin-audit
WP Associate Post R2 wp-associate-post-r2
WP Booking System – Booking Calendar wp-booking-system
WP Coder – Insert & Manage Code Snippets wp-coder
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments delete-all-comments-of-website
WP CV Builder cv-builder
WP Directory Kit wpdirectorykit
WP Dummy Content Generator wp-dummy-content-generator
WP Duplicate – WordPress Migration Plugin local-sync
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce wp-event-manager
WP File Download wp-file-download
WP Mailster wp-mailster
WP Meteor Website Speed Optimization Addon wp-meteor
WP Photo Album Plus wp-photo-album-plus
WP Plugin Info Card wp-plugin-info-card
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars wp-post-author
WP Posts Password Batch Manager wp-posts-password-batch-manager
WP Rocket wp-rocket
WP Rollback – Rollback Plugins and Themes wp-rollback
WP Store Locator wp-store-locator
WP Synchro – The Ultimate WordPress Migration Tool wpsynchro
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export wp-ultimate-csv-importer
WP User Profiles wp-user-profiles
WP Verify API wp-verify-api
WP-Invoice – Web Invoice and Billing wp-invoice
WP-Partner wp-partner
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden wp2leads
WPAdverts – Classifieds Plugin wpadverts
WPBase Cache wpbase-cache
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPCOM Member wpcom-member
WPComplete wpcomplete
WpCues Basic Quiz wpcues-basic-quiz
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More wpforms-lite
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent
WPML Multilingual & Multicurrency for WooCommerce woocommerce-multilingual
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) wpo365-login
wpsection wpsection
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress wpvr
WXD Backup Lite wxd-backup-lite
XServer Migrator xserver-migrator
Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc
YITH WooCommerce Affiliates yith-woocommerce-affiliates
YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons
YITH WooCommerce Product Bundles yith-woocommerce-product-bundles
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify
Zero Spam for WordPress zero-spam
Zotpress zotpress
WordPress Themes with Reported Vulnerabilities Last Week
Software Name Software Slug
Aalto - Architecture and Interior Design WordPress Theme aalto
Alliance | Intranet & Extranet BuddyPress WordPress Theme alliance
Ambed - Wallpapers & Painting Services WordPress Theme ambed
Ambient - Modern Interior Design and Decoration WordPress Theme ambient
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme anesta
Angio - Creative Music Theme angio
Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) armania
asia-garden asia-garden
Avada | Website Builder For WordPress & WooCommerce Avada
Avala - Wedding & Event WordPress Theme avala
Backhoe - Construction Equipment Rentals WordPress Theme backhoe
Balance balance
Biolife - Organic Food WordPress Theme ( RTL Supported ) biolife
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL booklovers
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) kute-boutique
Buzz Stone | Magazine & Viral Blog WordPress Theme buzzstone
Camelia | Floral Studio Florist WordPress Theme camelia
Cardea - Portfolio One Page WordPress Theme cardea-wp
CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor cleanskin
colorit colorit
Convex - Architecture & Interior Design WordPress Theme convex
DK dk
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme doctreat
Drone Media | Aerial Photography & Videography Theme drone-media
Duka Market - Multipurpose eCommerce Template dukamarket
Dwell - Building, Construction & Renovation Theme dwell
Edema | Wellness & Spa WordPress Theme edema
Education Center | LMS & Online Courses WordPress Theme education
Educavo - Education WordPress Theme educavo
EduMall - Professional LMS Education Center WordPress Theme edumall
Equadio equadio
Fabius - One Page Resume WordPress Theme fabius-wp
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop fcunited
Flipmart - MegaOne Multipurpose WordPress Theme flipmart
FoodBakery | Food Delivery Single & Multiple Restaurant Template foodbakery
grandnews grandnews
Graphene graphene
Greeny - Electric Car Dealership WordPress Theme greeny
Grocery Shopping Store grocery-shopping-store
Gutentype | 100% Gutenberg Blog Theme + Elementor gutentype
Hogwords | School, University Education WordPress Theme hogwords
Hygia - Cleaning Services WordPress Theme hygia
Invetex invetex
iPharm - Online Pharmacy Woocommerce Elementor Template Kit ipharm
jacqueline jacqueline
Jannah - Newspaper Magazine News BuddyPress AMP jannah
JobZilla - Job Board WordPress Theme jobzilla
Juno | Kids Toys & Games Store WordPress Theme junotoys
Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support kalles
Kaven - Business One Page WordPress Theme kaven-wp
Kicker - Blog Magazine Theme kicker
Kids Planet - Children Kindergarten and Playgroup WordPress Theme kidsplanet
kidscare kidscare
kuteshop kuteshop
Law Office law-office
Let's Play | Hockey School & Winter Sports WordPress Theme playhockey
LMS - Education WordPress Theme lms
Martfury - Marketplace Mobile App Figma Template martfury
Motors - Car Dealer, Rental & Listing WordPress theme motors
N7 n7-golf-club
Neo | Barber Shop WordPress Theme neocut
Ogency - Web Design Agency WordPress Theme ogency
Original original
Ozeum | Art Gallery and Museum Theme ozeum
Partiso | Political Party & Candidate Elementor Template Kit partiso
Photolia | Photo Company & Supply Store WordPress Theme photolia
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission pin-wp
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT qwery
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme rosalinda
ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme shift-cv
Smart Casa | Home Automation & House Technologies WordPress Theme smart-casa
Smash - Tennis WordPress Theme smash
Splendour splendour
Stargaze stargaze
Tantra | Yoga Studio and Fitness Club WordPress Theme tantra
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) techone
Teoro - One Page WordPress Theme teoro-wp
Th Shop Mania th-shop-mania
The Voux - A Multipurpose News & Magazine WordPress Theme thevoux-wp
The7 — Website and eCommerce Builder for WordPress dt-the7
tipsy tipsy
TouchUp - Cosmetic and Plastic Surgery WordPress Theme touchup
Travel Booking WordPress Theme traveler
Travesia | Travel Agency and Tour Booking WordPress Theme travesia
Treck - Immigration and Visa Consulting WordPress Theme treck
TutorStarter tutorstarter
Uminex - Multipurpose WooCommerce Theme uminex
Veto - Politics, Campaign & Candidate WordPress Theme veto
Voldor - Welding & Metal Work WordPress Theme voldor
Volos - One Page Resume WordPress Theme volos-wp
Werkstatt - Creative Portfolio WordPress Theme werkstatt
Whistle - Sports Clothing & Fitness Equipment whistle-sports-club
Windsor - Apartment Complex Single Property WordPress Theme windsor
Wine House | Winery & Restaurant WordPress Theme wine-house
WineShop - Food & Wine Store WordPress Theme wineshop
Woffice CRM woffice
WP Rentals - Booking Accommodation WordPress Theme wprentals
WPLMS Learning Management System for WordPress, WordPress LMS wplms
Yacht Rental - Boat Services WordPress Theme yacht-rental
Zeinet - Internet Provider & Satellite TV zeinet
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-103889
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
3D Product configurator for WooCommerce [expivi]
Researcher
Osman Hussein
More Details >
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104732
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced IP Blocker [advanced-ip-blocker]
Researcher
Wordfence PRISM
More Details >
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104028
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Anton Extensions [4nton-extensions]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-85097
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Bricksforge [bricksforge]
Researcher
d.v4n_s3c
More Details >
Doctreat - Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-39770
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Muhammad Sobirov
More Details >
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-94589
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]
Researcher
Osman Hussein
More Details >
Freeton WP <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-84737
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Freeton WP [freeton-wp]
Researcher
Naoki Kawahigashi
More Details >
Mindstien Quick Login <= 1.0 - Unauthenticated Privilege Escalation via Account Takeover
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-84734
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Raphael P. Cigana
More Details >
Tailored Tools <= 3.0.3 - Unauthenticated Arbitrary File Upload
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-62025
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tailored Tools [tailored-tools]
Researcher
V1T
More Details >
Tonda Membership <= 1.0.1 - Unauthenticated Privilege Escalation
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-62022
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tonda Membership [tonda-membership]
Researcher
Tran Nguyen Bao Khanh
More Details >
Tourfic Pro <= 1.17.3 - Unauthenticated Privilege Escalation
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-39774
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Tourfic Pro [tourfic-pro]
Researcher
Jamaal ahmed
More Details >
WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-104803
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WPCOM Member [wpcom-member]
Researcher
mamgad
More Details >
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-97670
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
whatm
More Details >
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Unauthenticated Arbitrary File Deletion
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-105892
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Dthangws
More Details >
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-39792
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Simple File List [simple-file-list]
Researcher
Philipp Doblhofer
More Details >
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
9.1
CVSS Rating
9.1 (Critical)
CVE-ID
CVE-2026-17609
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
d.v4n_s3c
More Details >
ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-105701
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Wordfence PRISM
More Details >
CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-62024
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
CodeBard Help Desk [codebard-help-desk]
Researcher
JunHee CHO
More Details >
Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39725
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Content Visibility for Divi Builder [content-visibility-for-divi-builder]
Researcher
ParkHyunWoo
More Details >
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-62129
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wordfence PRISM
More Details >
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-17196
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Forms – Drag & Drop Form Builder [super-forms]
Researcher
d.v4n_s3c
More Details >
Taskbot <= 6.6 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39757
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Taskbot [taskbot]
Researcher
Jamaal ahmed
More Details >
Veeqo for WooCommerce <= 2.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-93550
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Veeqo for WooCommerce [veeqo-for-woocommerce]
Researcher
Naoki Kawahigashi
More Details >
Workreap Core <= 3.4.5 - Authenticated (Employer / Sales Representative+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39759
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Workreap Core [workreap_core]
Researcher
Jamaal ahmed
More Details >
WP Duplicate – WordPress Migration Plugin <= 1.1.11 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVSS Rating
8.8 (High)
CVE-ID
CVE-2026-39755
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Aurélien BOURDOIS
More Details >
Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42777
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Aalto - Architecture and Interior Design WordPress Theme [aalto]
Researcher
João Pedro S Alcântara
More Details >
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104797
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced Form Integration — Connect Forms to 300+ Apps [advanced-form-integration]
Researcher
wachirapong kamphapong (wachiss)
More Details >
AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104398
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
AFFI – Affiliate Marketing for WooCommerce [affi-affiliate-marketing-for-woo]
Researcher
V1T
More Details >
Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78529
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
João Pedro S Alcântara
More Details >
Asia Garden <= 1.3.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62125
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
asia-garden [asia-garden]
Researcher
johska
More Details >
Avala <= 1.1.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62077
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
João Pedro S Alcântara
More Details >
Backhoe <= 2.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62075
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Backhoe - Construction Equipment Rentals WordPress Theme [backhoe]
Researcher
João Pedro S Alcântara
More Details >
Balance <= 1.12.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93945
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Balance [balance]
Researcher
Bonds
More Details >
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62096
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42718
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]
Researcher
John Ryan Albon
More Details >
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62099
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-81797
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Buzz Stone | Magazine & Viral Blog WordPress Theme [buzzstone]
Researcher
daroo
More Details >
Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93944
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Camelia | Floral Studio Florist WordPress Theme [camelia]
Researcher
Bonds
More Details >
Cardea <= 2.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62065
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Cardea - Portfolio One Page WordPress Theme [cardea-wp]
Researcher
João Pedro S Alcântara
More Details >
CleanSkin <= 1.5.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42724
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Bonds
More Details >
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.27 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62032
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing [directorypress]
Researcher
0xzenko
More Details >
Drone Media | Aerial Photography & Videography Theme <= 2.2.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66482
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Drone Media | Aerial Photography & Videography Theme [drone-media]
Researcher
João Pedro S Alcântara
More Details >
Duka Market - Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-48194
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Dwell - Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93942
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Dwell - Building, Construction & Renovation Theme [dwell]
Researcher
Bonds
More Details >
Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93941
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Bonds
More Details >
Equadio <= 1.1.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62087
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Equadio [equadio]
Researcher
johska
More Details >
Fabius - One Page Resume WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62069
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Fabius - One Page Resume WordPress Theme [fabius-wp]
Researcher
João Pedro S Alcântara
More Details >
FC United <= 1.1.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66565
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
FC United | Football, Soccer & Sports WordPress Theme + Events & Shop [fcunited]
Researcher
João Pedro S Alcântara
More Details >
Flipmart - MegaOne Multipurpose WordPress Theme <= 2.8 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62070
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
João Pedro S Alcântara
More Details >
FoodBakery <= 4.6 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78530
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Tran Nguyen Bao Khanh
More Details >
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104899
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Wordfence PRISM
More Details >
Greeny - Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93940
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Greeny - Electric Car Dealership WordPress Theme [greeny]
Researcher
Bonds
More Details >
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-92975
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Wordfence PRISM
More Details >
Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62046
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Gutentype | 100% Gutenberg Blog Theme + Elementor [gutentype]
Researcher
João Pedro S Alcântara
More Details >
Hogwords | School, University Education WordPress Theme <= 1.2.7 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93938
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Hogwords | School, University Education WordPress Theme [hogwords]
Researcher
Bonds
More Details >
Hygia - Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93937
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Bonds
More Details >
Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-78531
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
jacqueline [jacqueline]
Researcher
Bonds
More Details >
Job Postings <= 2.8.2 - Authenticated (Contributor+) Arbitrary File Deletion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-39752
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Job Postings [job-postings]
Researcher
hhhai
More Details >
Juno <= 2.25 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62086
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Juno | Kids Toys & Games Store WordPress Theme [junotoys]
Researcher
johska
More Details >
Kalles <= 1.1.7.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62076
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support [kalles]
Researcher
João Pedro S Alcântara
More Details >
Kaven <= 1.2 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62067
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kaven - Business One Page WordPress Theme [kaven-wp]
Researcher
João Pedro S Alcântara
More Details >
Kicker - Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66569
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Kicker - Blog Magazine Theme [kicker]
Researcher
João Pedro S Alcântara
More Details >
Kids Care <= 3.2.4 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42704
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kidscare [kidscare]
Researcher
Tran Nguyen Bao Khanh
More Details >
KuteShop <= 4.2.9 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62115
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kuteshop [kuteshop]
Researcher
João Pedro S Alcântara
More Details >
Law Office <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62120
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Law Office [law-office]
Researcher
johska
More Details >
Let's Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93935
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Let's Play | Hockey School & Winter Sports WordPress Theme [playhockey]
Researcher
Bonds
More Details >
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-105436
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]
Researcher
Rafie Muhammad
More Details >
N7 <= 2.21 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62124
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
N7 [n7-golf-club]
Researcher
johska
More Details >
Original <= 1.9.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66568
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Original [original]
Researcher
Bonds
More Details >
Ozeum | Art Gallery and Museum Theme <= 1.3.0 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62074
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Ozeum | Art Gallery and Museum Theme [ozeum]
Researcher
João Pedro S Alcântara
More Details >
Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93934
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Partiso | Political Party & Candidate Elementor Template Kit [partiso]
Researcher
Bonds
More Details >
payever – WooCommerce Gateway <= 4.8.2 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-42716
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93933
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Bonds
More Details >
Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93932
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Smart Casa | Home Automation & House Technologies WordPress Theme [smart-casa]
Researcher
Bonds
More Details >
Smash - Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93931
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Smash - Tennis WordPress Theme [smash]
Researcher
Bonds
More Details >
Splendour <= 1.23 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62050
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Splendour [splendour]
Researcher
johska
More Details >
Stargaze <= 1.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62051
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Stargaze [stargaze]
Researcher
johska
More Details >
String Locator <= 2.6.7 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-97188
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
String locator [string-locator]
Researcher
Raphael P. Cigana
More Details >
Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93930
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Tantra | Yoga Studio and Fitness Club WordPress Theme [tantra]
Researcher
Bonds
More Details >
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62094
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Teoro <= 1.1 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62068
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Teoro - One Page WordPress Theme [teoro-wp]
Researcher
João Pedro S Alcântara
More Details >
The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-39797
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
The GDPR Framework By Data443 [gdpr-framework]
Researcher
LevinityCyber
More Details >
The Voux <= 6.9.5 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94067
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
The Voux - A Multipurpose News & Magazine WordPress Theme [thevoux-wp]
Researcher
Tran Nguyen Bao Khanh
More Details >
Tipsy <= 1.6 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62052
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
tipsy [tipsy]
Researcher
johska
More Details >
TouchUp < 1.4 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62020
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
TouchUp - Cosmetic and Plastic Surgery WordPress Theme [touchup]
Researcher
Tran Nguyen Bao Khanh
More Details >
Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93929
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Travesia | Travel Agency and Tour Booking WordPress Theme [travesia]
Researcher
Bonds
More Details >
Uminex - Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-48193
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Veto <= 1.6.0 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-93927
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Bonds
More Details >
Volos <= 1.2 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62066
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Volos - One Page Resume WordPress Theme [volos-wp]
Researcher
João Pedro S Alcântara
More Details >
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94062
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Windsor - Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-66563
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Windsor - Apartment Complex Single Property WordPress Theme [windsor]
Researcher
Bonds
More Details >
Wine House | Winery & Restaurant WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62053
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Wine House | Winery & Restaurant WordPress Theme [wine-house]
Researcher
johska
More Details >
WineShop - Food & Wine Store WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-62090
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
WineShop - Food & Wine Store WordPress Theme [wineshop]
Researcher
johska
More Details >
WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-94538
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP File Download [wp-file-download]
Researcher
t4g0
More Details >
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
8.1
CVSS Rating
8.1 (High)
CVE-ID
CVE-2026-104759
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
endy
More Details >
Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-91136
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Divi Plus [divi-plus]
Researcher
ShinThink
More Details >
Dynamic User Directory <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-42719
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Dynamic User Directory [dynamic-user-directory]
Researcher
Hiro
More Details >
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39785
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Gmedia Photo Gallery [grand-media]
Researcher
Coopernicus
More Details >
Llavero.io <= 0.1.4 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89213
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Llavero.io [llavero-io]
Researcher
RIA Labs
More Details >
Loja Automática <= 1.0.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89297
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Loja Automática [loja-automatica]
Researcher
Naoki Kawahigashi
More Details >
LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-87781
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
achmad sonif
More Details >
Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-103695
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Mobile builder [mobile-builder]
Researcher
Raphael P. Cigana
More Details >
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
7.5
CVSS Rating
7.5 (High)
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Music Store – WordPress eCommerce [music-store]
Researcher
Quentin VILLAIN
More Details >
Neo | Barber Shop WordPress <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94064
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Tran Nguyen Bao Khanh
More Details >
Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-41555
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Newsletter Subscription Form – User Subscriptions Form, Capture Email [newsletter-subscription-form]
Researcher
dzeusking
More Details >
Paymendo Bank Transfer <= 1.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89304
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Enrico Marcolini
More Details >
Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-42415
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Porto Theme - Functionality [porto-functionality]
Researcher
Rafie Muhammad
More Details >
Post Voting System <= 1.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89302
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Post Voting System [post-voting-system]
Researcher
Naoki Kawahigashi
More Details >
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-104392
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Pedro "TheZakMan" Araujo
More Details >
RecordBrowser <= 1.1.7 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89232
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Recordbrowser [recordbrowser]
Researcher
Theo Fonseca
More Details >
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89301
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]
Researcher
Supakiad S. (m3ez)
More Details >
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-39795
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
Aydan Arabadzha
More Details >
Site Setup Wizard <= 1.5.8 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89195
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Site Setup Wizard [site-setup-wizard]
Researcher
João Ramos Maciel
More Details >
Slider by 10Web – Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-105885
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Ananda Dhakal
More Details >
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-88930
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Naoki Kawahigashi
More Details >
Tainacan <= 1.3.0 - Authenticated (Custom Role+) PHP Object Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-94676
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Tainacan [tainacan]
Researcher
Ananda Dhakal
More Details >
Tcard WP <= 1.8.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-81420
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Tcard WP [tcard-wp]
Researcher
Theo Fonseca
More Details >
Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89235
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Testimonials by BestWebSoft [bws-testimonials]
Researcher
Enrico Marcolini
More Details >
Tickera – Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-105889
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rafie Muhammad
More Details >
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-82627
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator]
Researcher
0xd4rk5id3
More Details >
Verify API <= 1.0.0 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89299
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP Verify API [wp-verify-api]
Researcher
RIA Labs
More Details >
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-93746
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Brian Mungai
More Details >
WP Rocket < 3.23.5 - Unauthenticated Denial of Service
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-97076
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Rocket [wp-rocket]
Researcher
sahinyes
More Details >
WP-Partner <= 1.2.1 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89234
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP-Partner [wp-partner]
Researcher
Raúl Conesa
More Details >
WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQL Injection
7.5
CVSS Rating
7.5 (High)
CVE-ID
CVE-2026-89214
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WpCues Basic Quiz [wpcues-basic-quiz]
Researcher
João Ramos Maciel
More Details >
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-85118
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
AI Content Generator Marketing [ai-content-generator-marketing]
Researcher
Enrico Marcolini
More Details >
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-39773
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Doctreat Core [doctreat_core]
Researcher
Jamaal ahmed
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-96341
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
elaprendiz1927
More Details >
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-103692
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ryan Fabella
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-104405
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Filip Kowalski
More Details >
Meta Box AIO <= 3.7.1 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-39761
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Meta Box AIO [meta-box-aio]
Researcher
wackydawg
More Details >
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-106610
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
miniOrange OTP Login, Verification and SMS Notifications [miniorange-otp-verification]
Researcher
Aliou Cisse (KevineCharles)
More Details >
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-105070
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]
Researcher
Nixxies
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 - Unauthenticated Privilege Escalation
7.3
CVSS Rating
7.3 (High)
CVE-ID
CVE-2026-95594
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Erwan LR
More Details >
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107742
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
daroo
More Details >
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.16.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40804
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]
Researcher
Akbarov Rauf
More Details >
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-105318
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]
Researcher
Peter Tang
More Details >
Additional Order Filters for WooCommerce <= 1.24 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39800
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Additional Order Filters for WooCommerce [additional-order-filters-for-woocommerce]
Researcher
Tawatchai Pinsuwan
More Details >
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87762
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Adwised Web Push Notification [adwised]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39778
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Ansar Import – One Click Starter Sites – for WordPress Themes [ansar-import]
Researcher
K. Sorrachat
More Details >
ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39766
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
ARforms [arforms]
Researcher
Jamaal ahmed
More Details >
AWP Classifieds <= 4.4.8 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2025-15700
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Khaled Alenazi
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62116
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
hhhai
More Details >
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62034
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Nguyen Ba Khanh
More Details >
Blog, Posts and Category Filter for Elementor <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-40806
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]
Researcher
JunHee CHO
More Details >
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87764
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
neurotx
More Details >
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84261
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Erwan LR
More Details >
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84260
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Erwan LR
More Details >
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84258
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Erwan LR
More Details >
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-84259
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Erwan LR
More Details >
Coder 4.0 - 4.5.1 - Authenticated (Editor+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104677
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Ayush Srivastava
More Details >
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39745
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]
Researcher
dodoh4t
More Details >
Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39731
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Database for CF7 [database-for-cf7]
Researcher
ParkHyunWoo
More Details >
Document Embedder – let visitors read files without downloading <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62037
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Document Embedder – let visitors read files without downloading [document-emberdder]
Researcher
daroo
More Details >
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39781
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Document Gallery [document-gallery]
Researcher
duna
More Details >
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-14335
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researchers
skyv3il
AmonRa
More Details >
Educavo - Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-78534
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
dutafi
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Admin+) Arbitrary Plugin Installation
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104680
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104021
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Fastcache by Host.it [fastcache-by-host-it]
Researcher
Wordfence PRISM
More Details >
Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-94675
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Tarcísio Luchesi
More Details >
Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42709
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Food Menu – Restaurant Menu & Online Ordering for WooCommerce [tlp-food-menu]
Researcher
John Ryan Albon
More Details >
Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104814
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Form Block [form-block]
Researcher
V1T
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-102388
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
b1ue0cean
More Details >
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100147
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FunnelKit – Funnel Builder Plugin for WooCommerce Checkout [funnel-builder]
Researcher
crow
More Details >
FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42699
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
FV Player 8 [fv-player]
Researcher
Ananda Dhakal
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104672
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
jydae
More Details >
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103309
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]
Researcher
Guntur Wahyu Ramadhan
More Details >
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-107657
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Adrien Brunner
More Details >
HootBoard <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-86798
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
HootBoard – Bulletin Board For Your Organization & Team Communication [hootboard]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39784
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Coopernicus
More Details >
HTTP Requests Manager <= 1.3.11 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39724
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
crow
More Details >
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-81929
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ocean eComm Treasure Box [ocean-ecommerce]
Ocean Pro Demos [ocean-pro-demos]
Researchers
Alex Thomas
Wordfence Argus
More Details >
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-89417
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. [host-webfonts-local]
Researcher
uhcna
More Details >
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-12626
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Muni Nitish Kumar Yaddala (Stranger825)
More Details >
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42715
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
neurotx
More Details >
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-100161
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Photo Reviews for WooCommerce [woo-photo-reviews]
Researcher
Adrien Brunner
More Details >
picu – Online Photo Proofing Gallery <= 3.10.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104395
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Ivaylo
More Details >
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96840
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Jacek Sowiński (dzaku)
More Details >
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-75962
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]
Researcher
Adrien Brunner
More Details >
Prenotazioni <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-103305
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Prenotazioni [prenotazioni]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96682
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Presto Player [presto-player]
Researcher
20kilograma
More Details >
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39726
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Product Designer for WooCommerce WordPress | Lumise [lumise]
Researcher
dutafi
More Details >
Qode Music <= 2.1.8.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42631
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Qode Music [qode-music]
Researcher
Rafie Muhammad
More Details >
Qode Real Estate <= 1.1.7.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42632
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Qode Real Estate [qode-real-estate]
Researcher
Rafie Muhammad
More Details >
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96558
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kuba
More Details >
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-104752
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Karthik Ramakrishnan
More Details >
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96667
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Real Estate Manager – Property Listing and Agent Management [real-estate-manager]
Researcher
Morato Antoine
More Details >
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39760
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
João Pedro S Alcântara
More Details >
Slider by 10Web – Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42711
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
neurotx
More Details >
SmugMug Embed <= 3.13 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88826
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
SmugMug Embed [smugmug-embed]
Researcher
Enrico Marcolini
More Details >
Social Rocket – Social Sharing Plugin <= 1.3.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42418
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Social Rocket – Social Sharing Plugin [social-rocket]
Researcher
Zein
More Details >
Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42697
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Social Share Icons & Social Share Buttons [ultimate-social-media-plus]
Researcher
William Honnér
More Details >
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39750
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce [storegrowth-sales-booster]
Researcher
Pedro Pinho
More Details >
StreamCast – bring live radio to your site with a sleek player <= 2.4.5 - Unauthenticated Server-Side Request Forgery
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62030
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
StreamCast – bring live radio to your site with a sleek player [streamcast]
Researcher
Asim Alshaya
More Details >
Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Editor+) Remote Code Execution
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39776
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Tabs Responsive – With WooCommerce Product Tabs Extension [tabs-responsive]
Researcher
Ananda Dhakal
More Details >
Team Section Block – Showcase Team Members with Layout Options <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-62027
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Team Section Block – Showcase Team Members with Layout Options [team-section]
Researcher
Asim Alshaya
More Details >
Topcontent <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-88903
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Topcontent [topcontent]
Researcher
Naoki Kawahigashi
More Details >
Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42702
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Intrudify
More Details >
Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42634
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Video Background Block – Add Stunning Video Backgrounds to Any Section [video-background-block]
Researcher
John Ryan Albon
More Details >
VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-95684
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
VikBooking Hotel Booking Engine & PMS [vikbooking]
Researcher
zickzick2
More Details >
VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39790
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
VikRentCar Car Rental Management System [vikrentcar]
Researcher
dutafi
More Details >
Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-87760
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Web Vitals Tracking [web-vitals-tracking]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
WooCommerce Simple Auctions <= 3.0.10 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-42635
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
theviper17y
More Details >
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-96278
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
nh4tvd
More Details >
WPAdverts – Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-97263
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Sebastian Albrecht (mySebbe)
More Details >
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
7.2
CVSS Rating
7.2 (High)
CVE-ID
CVE-2026-39780
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]
Researcher
etomixer
More Details >
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2026-104898
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
Wordfence PRISM
More Details >
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
6.8
CVSS Rating
6.8 (Medium)
CVE-ID
CVE-2025-14123
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Redux Framework [redux-framework]
Researcher
shark3y
More Details >
Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-105872
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Product Configurator for WooCommerce [product-configurator-for-woocommerce]
Researcher
Ananda Dhakal
More Details >
Super Video player – Fully Customizable Video Player with Playlist <= 1.8.14 - Authenticated (Editor+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-62044
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Super Video player – Fully Customizable Video Player with Playlist [super-video-player]
Researcher
johska
More Details >
WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-62130
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPML Multilingual & Multicurrency for WooCommerce [woocommerce-multilingual]
Researcher
Ananda Dhakal
More Details >
YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection
6.6
CVSS Rating
6.6 (Medium)
CVE-ID
CVE-2026-106606
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ananda Dhakal
More Details >
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104915
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Wordfence PRISM
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-62117
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
she11f
More Details >
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-62098
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39771
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Karthik Ramakrishnan
More Details >
ListingPro Plugin <= 2.9.12 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42414
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
ListingPro Plugin [listingpro-plugin]
Researcher
Rafie Muhammad
More Details >
Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-104397
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Name Directory [name-directory]
Researcher
changsheng
More Details >
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-105317
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Deva Parekh
More Details >
Paymendo Bank Transfer <= 1.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-89305
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
paymendo – Bank Transfer (Lite) [paymendo-bank-transfer]
Researcher
Erwan LR
More Details >
Piotnet Addons For Elementor <= 7.1.71 - Authenticated (Contributor+) Arbitrary File Read
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39754
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
dutafi
More Details >
Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-42712
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Qode Tours [qode-tours]
Researcher
Rafie Muhammad
More Details >
SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-97348
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Rafie Muhammad
More Details >
Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-105076
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]
Researcher
Peter Tang
More Details >
W3 Total Cache <= 2.10.5 - Authenticated (Author+) Path Traversal
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-107321
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Karthik Ramakrishnan
More Details >
Woffice CRM <= 5.4.35 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39747
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Woffice CRM [woffice]
Researcher
Bonds
More Details >
WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-107712
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Spy0x7
More Details >
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-96653
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP Directory Kit [wpdirectorykit]
Researcher
Tarcísio Luchesi De Almeida Silva (Poystick)
More Details >
WP Post Author 4.0.0 - Authenticated (Contributor+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-108125
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Joshua Martinelle
More Details >
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Authenticated (Subscriber+) SQL Injection
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-25434
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]
Researcher
johska
More Details >
WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service
6.5
CVSS Rating
6.5 (Medium)
CVE-ID
CVE-2026-39767
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WPBase Cache [wpbase-cache]
Researcher
dodoh4t
More Details >
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-93883
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Advanced Classifieds & Directory Pro [advanced-classifieds-and-directory-pro]
Researcher
Ivaylo
More Details >
Adwised Web Push Notification <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-87761
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Adwised Web Push Notification [adwised]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97340
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Avada | Website Builder For WordPress & WooCommerce [Avada]
Researcher
Muhamad Visat
More Details >
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104400
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
V1T
More Details >
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14882
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Brizy – Page Builder [brizy]
Researcher
Webbernaut
More Details >
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-94421
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Church Admin [church-admin]
Researcher
刀 妖
More Details >
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14877
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]
Researcher
Webbernaut
More Details >
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96648
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Data Tables Generator by Supsystic [data-tables-generator-by-supsystic]
Researcher
braintx
More Details >
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-9696
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
theviper17y
More Details >
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102401
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Wordfence PRISM
More Details >
eCommerce Product Catalog <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105056
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Ananda Dhakal
More Details >
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105873
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Intrudify
More Details >
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105871
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
nh4tvd
More Details >
Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97396
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Email Marketing for WordPress and WooCommerce – Retainful [retainful]
Researcher
Trithem
More Details >
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-18558
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files [embed-any-document]
Researcher
Deva Parekh
More Details >
Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104652
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
John Ryan Albon
More Details >
Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104653
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39788
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Front End PM [front-end-pm]
Researcher
Ananda Dhakal
More Details >
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-6243
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Muhammad Yudha - DJ
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-42695
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Supakiad S.
More Details >
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97630
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Thaer Assfour
More Details >
Gallery PhotoBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-107323
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Andy Urlep
More Details >
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-14379
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]
Researcher
Supakiad S. (m3ez)
More Details >
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104993
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]
Researcher
Tai Ha (superx)
More Details >
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-91862
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Getwid – Gutenberg Blocks [getwid]
Researcher
nthng
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104404
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Intrudify
More Details >
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97643
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Wordfence PRISM
More Details >
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-17025
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Graphene [graphene]
Researcher
stealthcopter
More Details >
HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104393
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Intrudify
More Details >
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103520
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Intrudify
More Details >
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104762
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Intrudify
More Details >
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105397
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]
Researcher
HunterSploit
More Details >
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105060
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Logo Showcase – Logo Slider, Carousel & Sponsors Gallery [logo-showcase]
Researcher
Ananda Dhakal
More Details >
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105079
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Deva Parekh
More Details >
Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-97294
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
yzx001
More Details >
Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96563
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Kamil B.
More Details >
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104673
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Ananda Dhakal
More Details >
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-16776
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Wordfence PRISM
More Details >
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-104396
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Name Directory [name-directory]
Researcher
Masaya Morita
More Details >
PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-4791
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Intrudify
More Details >
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-103427
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Simple Membership [simple-membership]
Researcher
Maciej Komorowski
More Details >
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102393
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
fcc
More Details >
SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102774
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
SureDash – Community, Courses & Member Dashboard [suredash]
Researcher
Jacek Sowiński (dzaku)
More Details >
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-78068
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Omar Elshopky (3l5h0pky)
More Details >
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96743
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Table Field Add-on for ACF and SCF [advanced-custom-fields-table-field]
Researcher
Kuba
More Details >
Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-102402
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Team – Team Members Showcase Plugin [tlp-team]
Researcher
Wordfence PRISM
More Details >
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-96574
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission [wp-user-frontend]
Researcher
Tarcísio Luchesi De Almeida Silva (Poystick)
More Details >
WC Fields Factory <= 4.1.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-39727
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WC Fields Factory [wc-fields-factory]
Researcher
ParkHyunWoo
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
6.4
CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researchers
Zhengyu Liu
Jingcheng Yang
Gavin Zhong
More Details >
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62127
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Plugin Info Card [wp-plugin-info-card]
Researcher
V1T
More Details >
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-105078
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Store Locator [wp-store-locator]
Researcher
Intrudify
More Details >
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-62029
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]
Researcher
nh4tvd
More Details >
Zotpress <= 7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVSS Rating
6.4 (Medium)
CVE-ID
CVE-2026-27420
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Zotpress [zotpress]
Researcher
Muhammad Yudha
More Details >
AI Copilot – Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-39801
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
AI Copilot – Content Generator [ai-copilot-content-generator]
Researcher
hackthesoul
More Details >
FooSales <= 1.43.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93548
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
FooSales – Point of Sale (POS) for WooCommerce [foosales]
Researcher
Naoki Kawahigashi
More Details >
JobZilla - Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-39775
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Jamaal ahmed
More Details >
Koinonia Link 1.1.2 - 1.1.4 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-87782
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Koinonia Link [koinonia-link]
Researcher
Ryan Fabella
More Details >
Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-103694
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Mobile builder [mobile-builder]
Researcher
Raphael P. Cigana
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93509
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Löwen
More Details >
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-93509
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Löwen
More Details >
WP User Profiles <= 2.7.3 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVSS Rating
6.3 (Medium)
CVE-ID
CVE-2026-105058
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP User Profiles [wp-user-profiles]
Researcher
nguyen viet tin
More Details >
Ambed <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62064
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
João Pedro S Alcântara
More Details >
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94154
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Aurora Heatmap [aurora-heatmap]
Researcher
lhking
More Details >
Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62095
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-12054
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Yuvraj Tomar
More Details >
Education Center <= 3.6.12 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94063
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
EduMall - Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-39748
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
EduMall - Professional LMS Education Center WordPress Theme [edumall]
Researcher
dutafi
More Details >
Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-5725
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Favicon Rotator [favicon-rotator]
Researcher
Kitch
More Details >
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-87869
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
João Pedro S Alcântara
More Details >
If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-87971
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Utkarsh Choudhary
More Details >
Kids Planet - Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-57742
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Kids Planet - Children Kindergarten and Playgroup WordPress Theme [kidsplanet]
Researcher
João Pedro S Alcântara
More Details >
KuteShop <= 4.2.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62100
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
kuteshop [kuteshop]
Researcher
João Pedro S Alcântara
More Details >
Magee Shortcodes <= 2.1.1 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-105316
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Magee Shortcodes [magee-shortcodes]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Martfury - Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-57806
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Martfury - Marketplace Mobile App Figma Template [martfury]
Researcher
João Pedro S Alcântara
More Details >
Ogency <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94059
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Ogency - Web Design Agency WordPress Theme [ogency]
Researcher
Tran Nguyen Bao Khanh
More Details >
Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-89100
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Payment Plugins for Stripe WooCommerce [woo-stripe-payment]
Researcher
Adrien Brunner
More Details >
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62082
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission [pin-wp]
Researcher
João Pedro S Alcântara
More Details >
Subscribe to Comments <= 2.3.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-91829
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Het Kalariya
More Details >
TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-62093
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
ThemeStek Extras for LabtechCO Theme <= 8.4 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94160
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
ThemeStek Extras for LabtechCO Theme [themestek-labtechco-extras]
Researcher
João Pedro S Alcântara
More Details >
Treck <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94058
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Treck - Immigration and Visa Consulting WordPress Theme [treck]
Researcher
Tran Nguyen Bao Khanh
More Details >
Voldor <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94060
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Voldor - Welding & Metal Work WordPress Theme [voldor]
Researcher
Tran Nguyen Bao Khanh
More Details >
Whistle - Sports Club <= 4.2 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-94061
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
WPAdverts – Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-97264
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
neurotx
More Details >
WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-39722
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WPLMS Learning Management System for WordPress, WordPress LMS [wplms]
Researcher
João Pedro S Alcântara
More Details >
Zeinet <= 1.0.0 - Reflected Cross-Site Scripting
6.1
CVSS Rating
6.1 (Medium)
CVE-ID
CVE-2026-93951
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Zeinet - Internet Provider & Satellite TV [zeinet]
Researcher
Tran Nguyen Bao Khanh
More Details >
Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery
5.5
CVSS Rating
5.5 (Medium)
CVE-ID
CVE-2026-84224
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Mohammed Abd Alrahman
More Details >
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-104022
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Wordfence PRISM
More Details >
Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-103424
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Spam Protection for Forms & Comments. Anti-Spam by CleanTalk [cleantalk-spam-protect]
Researcher
Maciej Komorowski
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-17538
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
owlmind
More Details >
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-15178
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]
Researcher
Nadir Şensoy
More Details >
Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-5727
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Hello Plus [hello-plus]
Researcher
normaandersonfrank
More Details >
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-102291
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Jacek Sowiński (dzaku)
More Details >
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
5.4
CVSS Rating
5.4 (Medium)
CVE-ID
CVE-2026-103482
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Noptin – Newsletter, New Post Notifications & Email Automation [newsletter-optin-box]
Researcher
crow
More Details >
10WebSocial <= 1.4.35 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39787
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
10WebSocial [wd-instagram-feed]
Researcher
Ananda Dhakal
More Details >
Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105989
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researcher
Daniel Dhaniswara
More Details >
Accept PayPal Payments Using Contact Form 7 <= 4.0.6 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105990
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Accept PayPal Payments using Contact Form 7 [contact-form-7-paypal-extension]
Researchers
Enrico Marcolini
Claudio Marchesini
Dottor Marc
More Details >
Advanced Google reCAPTCHA <= 5.40 - Unauthenticated Login Protection Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-100518
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Advanced Google reCAPTCHA [advanced-google-recaptcha]
Researcher
Asim Alshaya
More Details >
Advanced Posts Listing – Show Post List Easily <= 1.0.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39796
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Advanced Posts Listing – Show Post List Easily [advanced-posts-listing]
Researcher
Mohamed Bassia
More Details >
Airwallex Online Payments Gateway <= 1.35.0 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103517
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Pedro Pinho
More Details >
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-6723
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Vũ Quang Huy
More Details >
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39756
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Appointment Bookings for Zoom GoogleMeet and more – Wappointment [wappointment]
Researcher
Md. Minaruzzaman Shovon
More Details >
Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39762
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]
Researcher
Averon Averenkov
More Details >
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86826
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Duy Tran
More Details >
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62118
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
she11f
More Details >
Bayarcash WooCommerce <= 4.4.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106609
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Bayarcash WooCommerce [bayarcash-wc]
Researcher
Nguyen Ba Khanh
More Details >
Booking Calendar < 11.8 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105193
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Calendar [booking]
Researcher
Olaf Schigt
More Details >
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-18496
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Booking Calendar [booking]
Researcher
Jonah Burgess (CryptoCat)
More Details >
Booking Package <= 1.7.29 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105995
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Package [booking-package]
Researcher
Md. Moniruzzaman Prodhan
More Details >
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39772
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms [captcha-bws]
Researcher
Ananda Dhakal
More Details >
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84254
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Contact Form 7 [cf7-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to Gravity Forms <= 1.0.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84253
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Gravity Forms [gf-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to Ninja Forms <= 1.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84251
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to Ninja Forms [click5-crm-add-on-to-ninja-forms]
Researcher
Enrico Marcolini
More Details >
click5 CRM add-on to WPForms <= 1.0.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-84252
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
click5 CRM add-on to WPForms [wpf-add-on-by-click5]
Researcher
Enrico Marcolini
More Details >
Contest Gallery <= 33.0.0 - Unauthenticated Unauthorized Account Activation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107120
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Peter Tang
More Details >
CURCY – Multi Currency for WooCommerce <= 2.2.17 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97071
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
CURCY – Multi Currency for WooCommerce [woo-multi-currency]
Researcher
dcs
More Details >
CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-3717
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
WP CV Builder [cv-builder]
Researcher
Teerachai Somprasong
More Details >
DK <= 3.2.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42706
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
DK [dk]
Researcher
Tran Nguyen Bao Khanh
More Details >
DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62043
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
DTX – Dynamic Text Extension for Contact Form 7 [contact-form-7-dynamic-text-extension]
Researcher
Asim Alshaya
More Details >
E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 - Missing Authroization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103351
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]
Researcher
Peter Tang
More Details >
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42638
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Ananda Dhakal
More Details >
Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105190
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Rik de Kok
More Details >
Edwiser Bridge – WordPress Moodle Integration <= 4.3.4 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39729
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Jakub Herman
More Details >
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-62038
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Jakub Herman
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105893
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Matthew Lapinski
More Details >
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97300
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Peter Tang
More Details >
Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105068
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]
Researcher
Ananda Dhakal
More Details >
FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104724
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Wordfence PRISM
More Details >
Fluent Affiliate Pro <= 1.6.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39789
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Affiliate Pro [fluent-affiliate-pro]
Researcher
Ananda Dhakal
More Details >
Fluent Booking Pro < 2.5.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105072
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Booking Pro [fluent-booking-pro]
Researcher
Ananda Dhakal
More Details >
Fluent Forms Pro Add On Pack <= 6.2.13 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94669
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Fluent Forms Pro Add On Pack [fluentformpro]
Researcher
Tarcísio Luchesi
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-65459
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
Ananda Dhakal
More Details >
Fundiin <= 3.4.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-81649
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Fundiin cho WooCommerce [fundiin]
Researcher(s): Unknown
More Details >
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103378
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Naoki Kawahigashi
More Details >
GIFT4U – Gift Cards All in One for Woo <= 1.1.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103357
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]
Researcher
dcs
More Details >
GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106600
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
GiveWP – Donation Plugin and Fundraising Platform [give]
Researcher
Enis Getmez
More Details >
Grand News <= 3.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42705
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
grandnews [grandnews]
Researcher
Tran Nguyen Bao Khanh
More Details >
Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39769
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Ananda Dhakal
More Details >
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104385
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]
Researcher
Ayukiab
More Details >
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106603
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
HollerBox — Fast & Effective Popups & Lead-Generation [holler-box]
Researcher
benzdeus
More Details >
Insurify <= 1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86717
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Naoki Kawahigashi
More Details >
Insurify <= 1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-85121
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Insurify – Order & Shipping Protection [insurify]
Researcher
Enrico Marcolini
More Details >
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103323
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Integration for Epos Now and WooCommerce [woo-epos-now-integration]
Researcher
Raphael P. Cigana
More Details >
Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106601
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Ananda Dhakal
More Details >
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105322
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Magee Shortcodes [magee-shortcodes]
Researcher
Erwan LR
More Details >
Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39791
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Peter Tang
More Details >
Morning for WooCommerce <= 2.4.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39723
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Morning for WooCommerce [wc-gateway-greeninvoice]
Researcher
ParkHyunWoo
More Details >
Motors - Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-93950
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Jonathan Dersch
More Details >
Motors – Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104399
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]
Researcher
Ananda Dhakal
More Details >
Museder RestoreOne <= 2.7.276 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41561
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Ananda Dhakal
More Details >
Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82211
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researcher
Naoki Kawahigashi
More Details >
Nexi XPay Build 7.2.2 - 7.6.2 - Unauthenticated Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-82212
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Nexi XPay Build [nexi-xpay-build]
Researchers
Pablo González Pérez
Francisco José Ramírez Vicente
Iñigo Sánchez Enciso
More Details >
Norvis Backup <= 1.1.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-41562
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Norvis Backup [norvis-backup]
Researcher
Ananda Dhakal
More Details >
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103365
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]
Researcher
R3D
More Details >
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94375
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]
Researcher
Boluwatife Opeyemi (tcyph3r)
More Details >
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 - Unauthenticated Arbitrary Order Payment Bypass
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-107420
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway [cryptocurrency-payments-using-metamask-for-woocommerce]
Researcher
luffy
More Details >
PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39751
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Jakub Herman
More Details >
PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization to Unauthenticated Settings Change
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42637
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
PayPlug for WooCommerce (Official) [payplug]
Researcher
Filip Kecman
More Details >
picu – Online Photo Proofing Gallery <= 3.10.1 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104406
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Ananda Dhakal
More Details >
Social Web Suite <= 4.1.12 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-88931
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish [social-web-suite]
Researcher
Naoki Kawahigashi
More Details >
Super Payments <= 1.43.0 - Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-103329
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Super Payments – WooCommerce Payment Gateway [super-payments]
Researcher
Naoki Kawahigashi
More Details >
Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42419
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Swish Migrate and Backup [swish-migrate-and-backup]
Researcher
Ananda Dhakal
More Details >
The7 — Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66588
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
The7 — Website and eCommerce Builder for WordPress [dt-the7]
Researcher
Bonds
More Details >
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-94275
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping [track-orders-for-woocommerce]
Researcher
Pedro Pinho
More Details >
TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39798
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]
Researcher
Abdullah Kareem "cyberkareem"
More Details >
TutorStarter <= 4.0.3 - Unauthenticated Unauthorized User Account Creation
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-104671
Patch Status
Patched
Published
Oct 6, 2026
Affected Software
TutorStarter [tutorstarter]
Researcher
Alexander Jurkschat
More Details >
UnitechPay <= 1.0.6.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-87841
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Timur Jurayev
More Details >
WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-39794
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WCFM – Multivendor Marketplace REST API for WooCommerce [wcfm-marketplace-rest-api]
Researcher
Lee chul woong
More Details >
Web Plura Backup & Restore – Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-42630
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Web Plura Backup & Restore – Local Backups, Restore & Recovery [web-plura-backup-restore-manager]
Researcher
Ananda Dhakal
More Details >
WeddingCity Lite <= 1.0.4 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-106029
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WeddingCity Lite – Wedding Directory and Listing [weddingcity-lite]
Researcher
Naoki Kawahigashi
More Details >
WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-14854
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Mike Gozdiskowski
More Details >
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66666
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Ananda Dhakal
More Details >
WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-27434
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
João Pedro S Alcântara
More Details >
WP Rocket < 3.23.5 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-97075
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WP Rocket [wp-rocket]
Researcher
T.Kalimullin
More Details >
WP Rollback – Rollback Plugins and Themes <= 3.1.2 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-66435
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP Rollback – Rollback Plugins and Themes [wp-rollback]
Researcher
Ananda Dhakal
More Details >
WPCafe <= 3.0.20 - Unauthenticated Information Exposure
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-86816
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Phat RiO | João Pedro S Alcântara
More Details >
YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105878
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
sungbyeongchan
More Details >
Zero Spam for WordPress <= 5.7.11 - Unauthenticated Spam Protection Bypass on Login
5.3
CVSS Rating
5.3 (Medium)
CVE-ID
CVE-2026-105057
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Zero Spam for WordPress [zero-spam]
Researcher
Peter Tang
More Details >
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42721
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
ieuns
More Details >
Pix por Piggly (para Woocommerce) <= 2.1.2 - Authenticated (Shop Manager+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42714
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Pix por Piggly (para Woocommerce) [pix-por-piggly]
Researcher
Ananda Dhakal
More Details >
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104763
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Post Export Import with Media [post-export-import-with-media]
Researcher
Wordfence PRISM
More Details >
Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42713
Patch Status
Unpatched
Published
Oct 7, 2026
Affected Software
Post title marquee scroll [post-title-marquee-scroll]
Researcher
Ananda Dhakal
More Details >
Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104753
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Karthik Ramakrishnan
More Details >
Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-104023
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Wordfence PRISM
More Details >
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection
4.9
CVSS Rating
4.9 (Medium)
CVE-ID
CVE-2026-42708
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Jakub Herman
More Details >
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104050
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Morato Antoine
More Details >
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104049
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning [academy]
Researcher
Morato Antoine
More Details >
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103685
Patch Status
Patched
Published
Oct 10, 2026
Affected Software
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce [woo-alidropship]
Researcher
Je22y
More Details >
All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62036
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Bao
More Details >
App for Cloudflare® <= 1.10.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39749
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
App for Cloudflare® [app-for-cf]
Researcher
takito
More Details >
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105197
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Artus KG
More Details >
Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-91050
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Supakiad S. (m3ez)
More Details >
Asgaros Forum <= 3.4.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39779
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Asgaros Forum [asgaros-forum]
Researcher
buitu
More Details >
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104728
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI [automatorwp]
Researcher
Wordfence PRISM
More Details >
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107419
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AutoPoly – AI Translation For Polylang [automatic-translations-for-polylang]
Researcher
myhappyhoon
More Details >
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62028
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Before After Image Comparison – Visual Comparison for Two Images [before-after-image-compare]
Researcher
Asim Alshaya
More Details >
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104390
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Booktics – Appointment Booking Calendar for Service Businesses [booktics]
Researcher
Oly Hossen
More Details >
Comment Cleaner 6.1 - 7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107791
Patch Status
Patched
Published
Oct 10, 2026
Affected Software
Thanh Hang
More Details >
CP Media Player <= 1.3.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104678
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
CP Media Player – Audio Player and Video Player [audio-and-video-player]
Researcher
Ryan Fabella
More Details >
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62026
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Dashboard Notes [dashboard-notes]
Researcher
JunHee CHO
More Details >
Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105260
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Jakub Herman
More Details >
Disable Users <= 1.0.5 - Disabled Account Authorization Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-88827
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Disable Users [disable-users]
Researcher
Naoki Kawahigashi
More Details >
Dokan <= 5.1.0 - Authenticated (Vendor+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107694
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]
Researcher
Karthik Ramakrishnan
More Details >
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103964
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Download Manager [download-manager]
Researcher
Sawyer
More Details >
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105194
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104079
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Paul Serban
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Author+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104681
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Envira Gallery <= 1.16.1 - Authenticated (Author+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104684
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Muni Nitish Kumar Yaddala
More Details >
Envira Gallery <= 1.16.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104682
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Researcher
Karthik Ramakrishnan
More Details >
Event Tickets and Registration <= 5.30.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104675
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Intrudify
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105891
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
dzeusking
More Details >
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105888
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Erik Debye
More Details >
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106611
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]
Researcher
HOMEVO Adonis Orfel
More Details >
Frontend Dashboard <= 2.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103681
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Daniel Dhaniswara
More Details >
GDPR Data Request Form 1.5 - 1.7.1 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85348
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
GDPR Data Request Form [gdpr-data-request-form]
Researcher
Shikhali Jamalzade
More Details >
Grocery Shopping Store <= 1.3.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-93949
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Grocery Shopping Store [grocery-shopping-store]
Researcher
Nguyen Dinh Hai (HaiND)
More Details >
Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-84167
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Yaswanth Reddy Sunkara
More Details >
Hotel Booking <= 3.8 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-84166
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Hotel Booking [nd-booking]
Researcher
Yaswanth Reddy Sunkara
More Details >
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103075
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Dustin Lange
More Details >
Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104645
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Ala Bouali
More Details >
Jetpack VideoPress <= 3.6 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40808
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ananda Dhakal
More Details >
JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103078
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
KePulsary
More Details >
JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103079
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Rasyid Abdi Gantoro
More Details >
Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104401
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
JunHee CHO
More Details >
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-108695
Patch Status
Unpatched
Published
Oct 10, 2026
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
George Chen
More Details >
Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-96530
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
blast
More Details >
PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104407
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Intrudify
More Details >
Pubjet <= 5.4.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40802
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Pubjet | پابجت [pubjet]
Researcher
Aydan Arabadzha
More Details >
QA Assistants – Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105877
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
QA Assistants – Driven by data [qa-heatmap-analytics]
Researcher
Ananda Dhakal
More Details >
SendPress Newsletters <= 1.26.1.20 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-92989
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
SendPress Newsletters [sendpress]
Researcher
Enrico Marcolini
More Details >
Simple JWT Login – Allows you to use JWT on REST endpoints. 4.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39793
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
Simple JWT Login – Allows you to use JWT on REST endpoints. [simple-jwt-login]
Researcher
Taylsec
More Details >
Simple User Registration <= 6.9 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94235
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
MemberHero – Simple User Registration & Login [wp-registration]
Researcher
Yaswanth Reddy Sunkara
More Details >
Squadeno <= 1.11.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-107507
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Squadeno – Club Sports Manager [squadeno-club-sports-manager]
Researcher
Doston Abdullayev
More Details >
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39721
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
elaprendiz1927
More Details >
Th Shop Mania <= 1.9.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105883
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Th Shop Mania [th-shop-mania]
Researcher
Nguyen Dinh Hai (HaiND)
More Details >
Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-42698
Patch Status
Unpatched
Published
Oct 8, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
Ananda Dhakal
More Details >
Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-85571
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Tutor LMS – eLearning and online course solution [tutor]
Researcher
vuxvinh
More Details >
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105886
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets [ultimate-post-kit]
Researcher
Intrudify
More Details >
Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105064
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Unlimited Elements for Elementor [unlimited-elements-for-elementor]
Researcher
Ayukiab
More Details >
Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62035
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
Dahmani Toumi
More Details >
User Private Files <= 2.1.8 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97331
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
User Private Files – Secure File Sharing and Client Portal Plugin [user-private-files]
Researcher
Usama Arshad
More Details >
Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103335
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Ananda Dhakal
More Details >
VillaTheme Core <= 1.0.5 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-103072
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
VillaTheme Core [villatheme-core]
Researcher
Erik Debye
More Details >
Visual Composer Website Builder <= 45.16.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-106596
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Aarush Gaur
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94245
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Stefan Spasic
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94246
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Mytears
More Details >
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-94244
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments [wallet-system-for-woocommerce]
Researcher
Sanyam Jain
More Details >
Wise Chat <= 3.4.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-39730
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Wise Chat [wise-chat]
Researcher
takito
More Details >
Wordable – Export Google Docs to WordPress <= 8.2.10 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40801
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
Wordable – Export Google Docs to WordPress [wordable]
Researcher
Aydan Arabadzha
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
4.3
CVSS Rating
4.3 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
4.3
CVSS Rating
4.3 (Medium)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Anthropic
More Details >
WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62142
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WP 2FA – Two-factor authentication for WordPress [wp-2fa]
Researcher
Filip Kowalski
More Details >
WP Admin Audit <= 1.2.17 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105062
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Admin Audit [wp-admin-audit]
Researcher
Nixxies
More Details >
WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105059
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
longnv719
More Details >
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-62041
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce [wp-event-manager]
Researcher
Tai Ha (superx)
More Details >
WP Mailster <= 1.9.0.0 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-105055
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WP Mailster [wp-mailster]
Researcher
Ratchanon Chamnankit
More Details >
WP Synchro – The Ultimate WordPress Migration Tool <= 1.16.1 - 2-Factor Authentication Bypass
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-41558
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP Synchro – The Ultimate WordPress Migration Tool [wpsynchro]
Researcher
Ananda Dhakal
More Details >
WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-97183
Patch Status
Unpatched
Published
Oct 9, 2026
Affected Software
WP-Invoice – Web Invoice and Billing [wp-invoice]
Researcher
Usama Arshad
More Details >
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-25433
Patch Status
Unpatched
Published
Oct 5, 2026
Affected Software
WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden [wp2leads]
Researcher
johska
More Details >
WPComplete <= 2.9.5.6 - Cross-Site Request Forgery
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-66479
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
WPComplete [wpcomplete]
Researcher
Asim Alshaya
More Details >
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-102915
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Michał Wiencek
More Details >
wpsection <= 1.5.1 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-40777
Patch Status
Unpatched
Published
Oct 6, 2026
Affected Software
wpsection [wpsection]
Researcher
Suhayb Ahmed
More Details >
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 - Missing Authorization
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104386
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]
Researcher
Zac Lou
More Details >
Yaad Sarig Payment Gateway For WC <= 2.2.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVSS Rating
4.3 (Medium)
CVE-ID
CVE-2026-104651
Patch Status
Patched
Published
Oct 5, 2026
Affected Software
Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]
Researcher
Ryan Fabella
More Details >
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
3.7
CVSS Rating
3.7 (Low)
CVE-ID
CVE-2026-104006
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Kuba
More Details >
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
3.3
CVSS Rating
3.3 (Low)
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
WordPress [wordpress]
Researcher
Alex Concha
More Details >
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-104741
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]
Researcher
Wordfence PRISM
More Details >
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-104742
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
AI Puffer – MCP, AI Chatbot & Content Automation [gpt3-ai-content-generator]
Researcher
Wordfence PRISM
More Details >
Simple Membership <= 4.8.2 - Information Exposure
3.1
CVSS Rating
3.1 (Low)
CVE-ID
CVE-2026-88785
Patch Status
Patched
Published
Oct 9, 2026
Affected Software
Simple Membership [simple-membership]
Researcher
Rafael Honorato
More Details >
Booking Calendar 10.15 - 11.8.2 - Authenticated (Editor+) Information Exposure
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-105195
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
Booking Calendar [booking]
Researcher
vuxvinh
More Details >
Code Snippets <= 3.9.0 - Missing Authorization
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-106095
Patch Status
Patched
Published
Oct 7, 2026
Affected Software
Code Snippets [code-snippets]
Researcher
Mohammed Abd Alrahman
More Details >
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure
2.7
CVSS Rating
2.7 (Low)
CVE-ID
CVE-2026-94258
Patch Status
Patched
Published
Oct 8, 2026
Affected Software
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
SEARCH
Trust Your Site
to the Leader in WordPress Security
Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.
PROTECT YOUR SITE
Did you enjoy this post? Share it!
Facebook
X (Twitter)
LinkedIn
Comments
No Comments
All comments are moderated before being published. Inappropriate or off-topic comments may not be approved.
Breaking WordPress Security Research in your inbox as it happens.
By checking this box I agree to the terms of service and privacy policy.*
Our business hours are 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays.
Response customers receive 24-hour support, 365 days a year, with a 1-hour response time.
Terms of Service
Privacy Policy and Notice at Collection
Do Not Sell or Share My Personal Information
Products
Wordfence Free
Wordfence Premium
Wordfence Care
Wordfence Response
Wordfence CLI
Wordfence Intelligence
Wordfence Central
Support
Documentation
Learning Center
Free Support
Premium Support
News
Blog
In The News
Vulnerability Advisories
About
About Wordfence
Affiliate Program
Employment
Contact
Security
CVE Request Form
Stay Updated
Sign up for news and updates from our panel of experienced security professionals.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
