| 2026-10-23 |
WPSEC-2026-1479 |
QA Assistants – Driven by data | QA Assistants – Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting via 'event_ary' Parameter |
High 7.2 |
5.3.0.2 |
| 2026-10-22 |
WPSEC-2026-1478 |
Co-Authors Plus | Co-Authors Plus <= 4.1.1 - Authenticated (Editor+) Insecure Direct Object Reference to Post Co-Author Modification |
Low 3.8 |
4.1.2 |
| 2026-10-22 |
WPSEC-2026-1477 |
Overlay Image Divi Module | Overlay Image Divi Module <= 1.5.1 - Authenticated (Contributor+) Server-Side Request Forgery via Overlay Image Module Image URL |
Medium 6.4 |
1.5.3 |
| 2026-10-22 |
WPSEC-2026-1476 |
Sunshine Photo Cart | Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via Square Payment Method |
High 7.5 |
3.8 |
| 2026-10-22 |
WPSEC-2026-1475 |
Sunshine Photo Cart | Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN |
High 7.5 |
3.8 |
| 2026-10-22 |
WPSEC-2026-1474 |
Sunshine Photo Cart | Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion |
Medium 6.5 |
3.8 |
| 2026-10-22 |
WPSEC-2026-1473 |
Paytium: Mollie payment forms & donations | Paytium: Mollie payment forms & donations <= 5.0.5 - Unauthenticated PHP Object Injection via Payment Form Field Values |
High 8.1 |
5.0.6 |
| 2026-10-22 |
WPSEC-2026-1472 |
Webmention | Webmention <= 5.10.2 - Unauthenticated Server-Side Request Forgery via Webmention Source URL |
Medium 5.4 |
5.11.0 |
| 2026-10-22 |
WPSEC-2026-1471 |
Timetics – Appointment Booking Calendar & Scheduling | Timetics – Appointment Booking Calendar & Scheduling <= 1.0.64 - Unauthenticated Booking Disclosure, Cancellation and Rescheduling via Weak 'appointment_token' |
Medium 5.6 |
1.0.65 |
| 2026-10-22 |
WPSEC-2026-1470 |
WooCommerce PayPal Payments | WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint |
Medium 4.8 |
4.2.0 |
| 2026-10-22 |
WPSEC-2026-1469 |
Page and Post Restriction | Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via Comment Feeds and Comment Lists |
Medium 5.3 |
1.6.1 |
| 2026-10-22 |
WPSEC-2026-1468 |
Page and Post Restriction | Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via Role-Restricted Pages and Posts |
Low 3.7 |
1.6.1 |
| 2026-10-22 |
WPSEC-2026-1467 |
Page and Post Restriction | Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint |
Medium 5.3 |
1.6.1 |
| 2026-10-22 |
WPSEC-2026-1466 |
Page and Post Restriction | Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter |
Medium 5.3 |
1.6.1 |
| 2026-10-22 |
WPSEC-2026-1465 |
Go Fetch Jobs (for WP Job Manager) | Go Fetch Jobs (for WP Job Manager) <= 1.8.5.2 - Authenticated (Subscriber+) Missing Authorization to Feed Import and Template Actions |
Medium 5.4 |
2.0.2.1 |
| 2026-10-22 |
WPSEC-2026-1464 |
Advanced Form Integration | Advanced Form Integration <= 2.10.3 - Unauthenticated Arbitrary Shortcode Execution via Form Submission Values |
High 7.3 |
2.10.4 |
| 2026-10-22 |
WPSEC-2026-1463 |
GeoDirectory | GeoDirectory <= 2.8.194 - Authenticated (Subscriber+) Missing Authorization to Listing Status, Featured Flag, Expiry and Package Modification |
Medium 4.3 |
2.8.195 |
| 2026-10-22 |
WPSEC-2026-1462 |
GeoDirectory | GeoDirectory <= 2.8.194 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Badge Shortcode 'cta' and 'link' Attributes |
Medium 6.4 |
2.8.195 |
| 2026-10-22 |
WPSEC-2026-1461 |
Quote for WooCommerce Lite | Quote for WooCommerce Lite <= 1.5.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quote Details Disclosure |
Medium 4.3 |
1.5.8 |
| 2026-10-22 |
WPSEC-2026-1460 |
Post to Google My Business (Google Business Profile) | Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In |
Medium 4.3 |
3.5.4 |
| 2026-10-22 |
WPSEC-2026-1459 |
Easy Appointments | Easy Appointments <= 4.0.3 - Unauthenticated Authentication Bypass via Forgeable Legacy Appointment Action Token |
Low 3.7 |
4.0.4 |
| 2026-10-22 |
WPSEC-2026-1458 |
Easy Appointments | Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email |
Medium 4.3 |
4.0.4 |
| 2026-10-22 |
WPSEC-2026-1457 |
WordPress Contact Forms by Cimatti | WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download |
Medium 5.9 |
2.3.32 |
| 2026-10-22 |
WPSEC-2026-1456 |
Post Carousel | Post Carousel <= 4.0.8 - Authenticated (Contributor+) Sensitive Information Exposure via Saved Template Shortcode |
Medium 4.3 |
4.0.9 |
| 2026-10-22 |
WPSEC-2026-1455 |
Post Carousel | Post Carousel <= 4.0.8 - Unauthenticated Password-Protected Post Content and Non-Public Post Disclosure via sp_smart_post_block_all_post_query AJAX Action |
Medium 5.3 |
4.0.9 |
| 2026-10-22 |
WPSEC-2026-1454 |
Post Carousel | Post Carousel <= 4.0.8 - Unauthenticated Non-Public Post Type Information Exposure via Smart Search REST Endpoint |
Medium 5.3 |
4.0.9 |
| 2026-10-22 |
WPSEC-2026-1453 |
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Trashing via 'buycred-cancel' Parameter |
Medium 5.4 |
4.0.0 |
| 2026-10-22 |
WPSEC-2026-1452 |
Fattura24 | Fattura24 <= 8.2.0 - Missing Authorization to Unauthenticated Support Ticket Submission |
Medium 5.3 |
8.2.1 |
| 2026-10-22 |
WPSEC-2026-1451 |
Fattura24 | Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File |
Medium 5.9 |
8.2.1 |
| 2026-10-22 |
WPSEC-2026-1450 |
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund |
Medium 4.3 |
2.8.2 |
| 2026-10-22 |
WPSEC-2026-1449 |
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Authenticated (Subscriber+) Comment Reward Limit Bypass |
Medium 4.3 |
2.8.2 |
| 2026-10-22 |
WPSEC-2026-1448 |
Hustle – Email Marketing, Lead Generation, Optins, Popups | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Missing Authorization to Integration Settings Modification and Provider Migration |
Low 3.8 |
7.8.14.4 |
| 2026-10-22 |
WPSEC-2026-1447 |
Hustle – Email Marketing, Lead Generation, Optins, Popups | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Stored Cross-Site Scripting via CTA Button Label and Module Title |
Medium 5.5 |
7.8.14.4 |
| 2026-10-22 |
WPSEC-2026-1446 |
ProfileGrid – User Profiles, Groups and Communities | ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.4 - Authenticated (Subscriber+) PHP Object Injection via Profile Field Values |
High 7.5 |
6.0.0.5 |
| 2026-10-22 |
WPSEC-2026-1445 |
Zoho CRM Lead Magnet | Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title |
Medium 4.0 |
1.8.2.5 |
| 2026-10-22 |
WPSEC-2026-1444 |
Events Manager – Calendar, Bookings, Tickets, Appointments and more! | Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_rsvp_date' Parameter |
Medium 6.4 |
7.4.9 |
| 2026-10-22 |
WPSEC-2026-1443 |
Events Manager – Calendar, Bookings, Tickets, Appointments and more! | Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_search_form Shortcode Label Attributes |
Medium 6.4 |
7.4.9 |
| 2026-10-22 |
WPSEC-2026-1442 |
Events Manager – Calendar, Bookings, Tickets, Appointments and more! | Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Booking Approval Bypass and Authenticated (Subscriber+) Arbitrary Booking Cancellation via 'booking_id' Parameter Mass Assignment |
Medium 5.3 |
7.4.9 |
| 2026-10-22 |
WPSEC-2026-1441 |
MONEI Payments for WooCommerce | MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Order Payment Completion via Payment Reuse |
Medium 5.3 |
7.3.6 |
| 2026-10-22 |
WPSEC-2026-1440 |
MONEI Payments for WooCommerce | MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect |
Medium 4.2 |
7.3.6 |
| 2026-10-22 |
WPSEC-2026-1439 |
MONEI Payments for WooCommerce | MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update |
Medium 5.3 |
7.3.6 |
| 2026-10-22 |
WPSEC-2026-1438 |
JetFormBuilder — Dynamic Blocks Form Builder | JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Preset Field Values |
High 7.2 |
3.6.7.1 |
| 2026-10-22 |
WPSEC-2026-1437 |
Off-Canvas Sidebars & Menus (Slidebars) | Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ocs_trigger Shortcode |
Medium 6.4 |
0.5.9.1 |
| 2026-10-22 |
WPSEC-2026-1436 |
Responsive Plus | Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor HTML Widget Import |
Medium 6.4 |
3.5.5 |
| 2026-10-22 |
WPSEC-2026-1435 |
Responsive Plus | Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Elementor Page Content Overwrite via Template Import |
Medium 4.3 |
3.5.5 |
| 2026-10-22 |
WPSEC-2026-1434 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Cross-Site Request Forgery to Booking Modification and Custom Message Sending |
Medium 4.3 |
1.8.18 |
| 2026-10-22 |
WPSEC-2026-1433 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Sensitive Information Exposure via U-tec Webhook Debug Log |
Low 3.7 |
1.8.18 |
| 2026-10-22 |
WPSEC-2026-1432 |
Customer Email Verification for WooCommerce | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force |
Medium 5.3 |
2.8.3 |
| 2026-10-22 |
WPSEC-2026-1431 |
Customer Email Verification for WooCommerce | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via Predictable Verification Link |
Medium 5.3 |
2.8.3 |
| 2026-10-22 |
WPSEC-2026-1430 |
SureDash | SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via Quick View 'post_id' Parameter |
Medium 5.3 |
1.12.3 |
| 2026-10-22 |
WPSEC-2026-1429 |
SureDash | SureDash <= 1.12.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Unapproved Comments in Comment Lists |
Medium 4.3 |
1.12.3 |
| 2026-10-22 |
WPSEC-2026-1428 |
SureDash | SureDash <= 1.12.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Community Posts, Comments, and Profile Bio |
Medium 5.4 |
1.12.3 |
| 2026-10-22 |
WPSEC-2026-1427 |
SureDash | SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via REST API Community Posts and Comments |
Medium 5.3 |
1.12.3 |
| 2026-10-22 |
WPSEC-2026-1426 |
SureDash | SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts |
Medium 6.4 |
1.12.3 |
| 2026-10-22 |
WPSEC-2026-1425 |
Advanced Block Animation | Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script |
Medium 6.1 |
4.5.0 |
| 2026-10-22 |
WPSEC-2026-1424 |
GDPR Compliance & Cookie Consent | GDPR Compliance & Cookie Consent <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Data Access Form Class Settings |
Medium 4.4 |
1.6.3 |
| 2026-10-22 |
WPSEC-2026-1423 |
Mortgage Calculator | Mortgage Calculator <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mortgage_calculator' Shortcode 'title' Attribute |
Medium 6.4 |
1.3.1 |
| 2026-10-22 |
WPSEC-2026-1422 |
Rio EMI Calculator | Rio EMI Calculator <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Currency Display Setting |
Medium 4.4 |
1.4.2 |
| 2026-10-22 |
WPSEC-2026-1421 |
BMI Adult & Kid Calculator | BMI Adult & Kid Calculator <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id_calc' Shortcode Attribute |
Medium 6.4 |
1.2.4 |
| 2026-10-22 |
WPSEC-2026-1420 |
3D viewer – Embed 3D Models | 3D viewer – Embed 3D Models <= 1.9.4 - Authenticated (Contributor+) Sensitive Information Exposure via [3d_viewer] Shortcode |
Medium 4.3 |
2.0.0 |
| 2026-10-21 |
WPSEC-2026-1419 |
Jock On Air Now (JOAN) | Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie |
Medium 5.3 |
6.1.4 |
| 2026-10-21 |
WPSEC-2026-1418 |
Related Posts for WordPress | Related Posts for WordPress <= 3.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via Related Posts Link Screen and Meta Box |
Medium 4.3 |
3.0.1 |
| 2026-10-21 |
WPSEC-2026-1417 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom API Credential Modification via Migration Action |
Medium 5.3 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1416 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Deletion |
Medium 5.4 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1415 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Synchronization |
Medium 4.3 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1414 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Settings Map AJAX Action |
Medium 6.5 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1413 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Overwrite via Font Regeneration |
Medium 5.4 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1412 |
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Unauthenticated Zoom Meeting Host Role Escalation via Signature Generation |
Medium 6.5 |
1.7.2 |
| 2026-10-21 |
WPSEC-2026-1411 |
W3 Total Cache | W3 Total Cache <= 2.10.7 - Unauthenticated Minify Cache Poisoning via 'b' Parameter and Query String |
Medium 5.3 |
2.11.0 |
| 2026-10-21 |
WPSEC-2026-1410 |
W3 Total Cache | W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses |
Medium 4.7 |
2.11.0 |
| 2026-10-21 |
WPSEC-2026-1409 |
W3 Total Cache | W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders |
Low 3.7 |
2.11.0 |
| 2026-10-21 |
WPSEC-2026-1408 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Cross-Site Request Forgery to Booking Modification, Deletion and Data Export |
Medium 5.4 |
1.8.17 |
| 2026-10-21 |
WPSEC-2026-1407 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Reflected Cross-Site Scripting via 'vbo_active_tab', 'vbo_lang', 'goto' and 'status' Parameters |
Medium 6.1 |
1.8.17 |
| 2026-10-21 |
WPSEC-2026-1406 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Pre-Check-in Guest Fields |
Medium 5.4 |
1.8.17 |
| 2026-10-21 |
WPSEC-2026-1405 |
VikBooking Hotel Booking Engine & PMS | VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Customer Email |
Medium 6.1 |
1.8.17 |
| 2026-10-21 |
WPSEC-2026-1404 |
Picture Gallery – Frontend Image Uploads, AJAX Photo List | Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
Medium 6.4 |
1.7.21 |
| 2026-10-21 |
WPSEC-2026-1403 |
Picture Gallery – Frontend Image Uploads, AJAX Photo List | Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Path Traversal to Arbitrary File Read via 'importFiles' Parameter |
Medium 6.5 |
1.7.21 |
| 2026-10-21 |
WPSEC-2026-1402 |
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory | WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change |
Medium 4.2 |
2.10.0 |
| 2026-10-21 |
WPSEC-2026-1401 |
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Unauthorized Future Action Scheduling |
Medium 4.3 |
4.11.0 |
| 2026-10-21 |
WPSEC-2026-1400 |
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Term Creation |
Medium 4.3 |
4.11.0 |
| 2026-10-21 |
WPSEC-2026-1399 |
SureCart | SureCart <= 4.9.6 - Unauthenticated Authentication Bypass via Passwordless Login Verification Code |
Critical 9.8 |
4.10.0 |
| 2026-10-21 |
WPSEC-2026-1398 |
SureCart | SureCart <= 4.9.6 - Authenticated (Author+) Stored Cross-Site Scripting via Block Icon Name |
Medium 6.4 |
4.10.0 |
| 2026-10-21 |
WPSEC-2026-1397 |
SureCart | SureCart <= 4.9.6 - Unauthenticated Path Traversal via REST API 'id' Parameter |
Medium 6.5 |
4.10.0 |
| 2026-10-21 |
WPSEC-2026-1396 |
SureCart | SureCart <= 4.9.6 - Unauthenticated Open Redirect via Checkout 'page_url' Metadata |
Medium 6.1 |
4.10.0 |
| 2026-10-21 |
WPSEC-2026-1395 |
Pixel Manager for WooCommerce | Pixel Manager for WooCommerce <= 2.2.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update via AJAX Actions |
Medium 4.3 |
2.2.3 |
| 2026-10-21 |
WPSEC-2026-1394 |
LiteSpeed Cache | LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes |
Medium 4.9 |
7.9.2 |
| 2026-10-21 |
WPSEC-2026-1393 |
LiteSpeed Cache | LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Exposure via Preset Backup Files |
Medium 5.9 |
7.9.2 |
| 2026-10-21 |
WPSEC-2026-1392 |
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets | WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.1.3 - Cross-Site Request Forgery to Port Setting Update |
Medium 4.3 |
4.1.4 |
| 2026-10-21 |
WPSEC-2026-1391 |
GeoDirectory | GeoDirectory <= 2.8.193 - Unauthenticated Authorization Bypass to Guest Listing Ownership |
Medium 5.6 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1390 |
GeoDirectory | GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media |
High 7.6 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1389 |
GeoDirectory | GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference to Listing Attachment Modification |
Medium 4.3 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1388 |
GeoDirectory | GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings |
Medium 5.3 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1387 |
GeoDirectory | GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map and Post Badge Shortcode Attributes |
Medium 6.4 |
2.8.194 |
| 2026-10-21 |
WPSEC-2026-1386 |
Internet Archive Wayback Machine Link Fixer | Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation |
Medium 5.3 |
1.5.0 |
| 2026-10-21 |
WPSEC-2026-1385 |
Internet Archive Wayback Machine Link Fixer | Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Improper Certificate Validation Leading to archive.org Credential Exposure |
Low 3.7 |
1.5.0 |
| 2026-10-21 |
WPSEC-2026-1384 |
Product Addons for Woocommerce – Product Options with Custom Fields | Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Form Field Type |
Medium 4.4 |
3.1.9 |
| 2026-10-21 |
WPSEC-2026-1383 |
Booktics – Appointment Booking Calendar for Service Businesses | Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter |
Medium 6.5 |
1.0.31 |
| 2026-10-21 |
WPSEC-2026-1382 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action |
Medium 5.3 |
1.7.33 |
| 2026-10-21 |
WPSEC-2026-1381 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass |
Medium 5.3 |
1.7.33 |
| 2026-10-21 |
WPSEC-2026-1380 |
Booking Package | Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services |
Medium 5.3 |
1.7.33 |
