{
"schema_version": 1,
"generated_at": "2026-10-23T01:41:18+00:00",
"publisher": "WPSec (https://wpsec.com)",
"home": "https://wpsec.com/vuln/",
"feed": "https://wpsec.com/vuln/feed.xml",
"documentation": "https://wpsec.com/vuln/about/#data",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/",
"attribution": "Credit WPSec and link to the advisory, or to https://wpsec.com/vuln/ for the whole dataset."
},
"count": 1481,
"advisories": [
{
"id": "WPSEC-2026-1481",
"url": "https://wpsec.com/vuln/WPSEC-2026-1481/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1481/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1481/index.md",
"title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Carousel Widget Image URL",
"description": "The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the item image URL of the Info Box Carousel widget in all versions up to, and including, 3.1.1, due to insufficient output escaping of the image URL in the widget's Elementor editor template, where it is printed unescaped inside the img src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user, including an administrator, opens the affected content in the Elementor editor or its preview.",
"plugin": {
"slug": "powerpack-lite-for-elementor",
"name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
"full_name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
"wordpress_org": "https://wordpress.org/plugins/powerpack-lite-for-elementor/",
"advisories_url": "https://wpsec.com/vuln/plugin/powerpack-lite-for-elementor/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.1.2",
"to_inclusive": false
}
],
"text": [
"all versions before 3.1.2"
]
},
"introduced_in": null,
"fixed_in": "3.1.2",
"remediation": "Update to 3.1.2 or later.",
"fix_released": "2026-10-22T01:37:58+00:00",
"published": "2026-10-23T01:41:18+00:00",
"updated": "2026-10-22T09:32:58.460723+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1481/",
"https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/",
"https://wordpress.org/plugins/powerpack-lite-for-elementor/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1480",
"url": "https://wpsec.com/vuln/WPSEC-2026-1480/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1480/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1480/index.md",
"title": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.1 - Authenticated (Contributor+) Sensitive Information Exposure via Posts, Content Ticker and Marquee Widget Filter Settings",
"description": "The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Sensitive Information Exposure via the Posts, Content Ticker and Marquee widgets in all versions up to, and including, 3.1.1. This is due to the author and post filter type widget settings being used directly as WP_Query argument keys without restricting them to allowed values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary query variables such as post_status and render the contents of private, draft, pending or scheduled posts they should not be able to view.",
"plugin": {
"slug": "powerpack-lite-for-elementor",
"name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
"full_name": "PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)",
"wordpress_org": "https://wordpress.org/plugins/powerpack-lite-for-elementor/",
"advisories_url": "https://wpsec.com/vuln/plugin/powerpack-lite-for-elementor/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.1.2",
"to_inclusive": false
}
],
"text": [
"all versions before 3.1.2"
]
},
"introduced_in": null,
"fixed_in": "3.1.2",
"remediation": "Update to 3.1.2 or later.",
"fix_released": "2026-10-22T01:37:58+00:00",
"published": "2026-10-23T01:41:18+00:00",
"updated": "2026-10-22T09:32:58.460723+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1480/",
"https://plugins.svn.wordpress.org/powerpack-lite-for-elementor/tags/3.1.2/",
"https://wordpress.org/plugins/powerpack-lite-for-elementor/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-lite-for-elementor",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1479",
"url": "https://wpsec.com/vuln/WPSEC-2026-1479/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1479/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1479/index.md",
"title": "QA Assistants – Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting via 'event_ary' Parameter",
"description": "The QA Assistants – Driven by data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_ary' parameter of the public behavioral tracking endpoint in all versions up to, and including, 5.3.0.1, due to insufficient input validation of submitted event rows and insufficient output escaping when the recorded event data is embedded in a single-quoted JavaScript string on the session replay screen. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator or another user with analytics access views the replay of the affected session.",
"plugin": {
"slug": "qa-heatmap-analytics",
"name": "QA Assistants – Driven by data",
"full_name": "QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages",
"wordpress_org": "https://wordpress.org/plugins/qa-heatmap-analytics/",
"advisories_url": "https://wpsec.com/vuln/plugin/qa-heatmap-analytics/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.2,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "5.3.0.2",
"to_inclusive": false
}
],
"text": [
"all versions before 5.3.0.2"
]
},
"introduced_in": null,
"fixed_in": "5.3.0.2",
"remediation": "Update to 5.3.0.2 or later.",
"fix_released": "2026-10-22T00:40:04+00:00",
"published": "2026-10-23T00:41:49+00:00",
"updated": "2026-10-22T09:33:26.700396+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1479/",
"https://plugins.svn.wordpress.org/qa-heatmap-analytics/tags/5.3.0.2/",
"https://wordpress.org/plugins/qa-heatmap-analytics/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1478",
"url": "https://wpsec.com/vuln/WPSEC-2026-1478/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1478/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1478/index.md",
"title": "Co-Authors Plus <= 4.1.1 - Authenticated (Editor+) Insecure Direct Object Reference to Post Co-Author Modification",
"description": "The Co-Authors Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coauthors/v1 REST endpoints for reading and updating a post's co-authors and via the bulk edit co-author handler in versions 3.5 up to, and including, 4.1.1. This is because these paths only checked whether the user could assign authors in general, not whether the user could edit the specific post. Bulk edit also applied co-authors to submitted posts that WordPress core had skipped. This makes it possible for authenticated attackers who can assign authors (by default users with the edit_others_posts capability, such as Editors) to read and replace the co-authors, and with them the post_author, of posts they are not allowed to edit.",
"plugin": {
"slug": "co-authors-plus",
"name": "Co-Authors Plus",
"full_name": "Co-Authors Plus",
"wordpress_org": "https://wordpress.org/plugins/co-authors-plus/",
"advisories_url": "https://wpsec.com/vuln/plugin/co-authors-plus/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/co-authors-plus"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": "3.5",
"from_inclusive": true,
"to": "4.1.2",
"to_inclusive": false
}
],
"text": [
"from 3.5 before 4.1.2"
]
},
"introduced_in": "3.5",
"fixed_in": "4.1.2",
"remediation": "Update to 4.1.2 or later.",
"fix_released": "2026-10-21T22:39:49+00:00",
"published": "2026-10-22T22:43:14+00:00",
"updated": "2026-10-22T09:33:01.043275+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1478/",
"https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.2/",
"https://wordpress.org/plugins/co-authors-plus/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/co-authors-plus",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1477",
"url": "https://wpsec.com/vuln/WPSEC-2026-1477/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1477/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1477/index.md",
"title": "Overlay Image Divi Module <= 1.5.1 - Authenticated (Contributor+) Server-Side Request Forgery via Overlay Image Module Image URL",
"description": "The Overlay Image Divi Module plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'src' (image URL) attribute of the Overlay Image module in all versions up to, and including, 1.5.1, due to the module's render function passing the user-supplied image URL to getimagesize() without validation whenever allow_url_fopen is enabled. This makes it possible for authenticated attackers with contributor-level access and above to make web requests to arbitrary locations, including internal services, from the web application when a post containing the module is rendered or previewed.",
"plugin": {
"slug": "overlay-image-divi-module",
"name": "Overlay Image Divi Module",
"full_name": "Overlay Image Divi Module",
"wordpress_org": "https://wordpress.org/plugins/overlay-image-divi-module/",
"advisories_url": "https://wpsec.com/vuln/plugin/overlay-image-divi-module/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/overlay-image-divi-module"
},
"type": "SSRF",
"cwe": [
"CWE-918"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.5.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.5.3"
]
},
"introduced_in": null,
"fixed_in": "1.5.3",
"remediation": "Update to 1.5.3 or later.",
"fix_released": "2026-10-21T22:39:17+00:00",
"published": "2026-10-22T22:43:14+00:00",
"updated": "2026-10-22T10:09:26.499014+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1477/",
"https://plugins.svn.wordpress.org/overlay-image-divi-module/tags/1.5.3/",
"https://wordpress.org/plugins/overlay-image-divi-module/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/overlay-image-divi-module",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1476",
"url": "https://wpsec.com/vuln/WPSEC-2026-1476/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1476/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1476/index.md",
"title": "Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via Square Payment Method",
"description": "The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the Square payment method in all versions up to, and including, 3.7.5, due to the checkout trusting the 'square_payment_id' value submitted by the browser without confirming with Square that the payment exists, was completed, and matches the order's amount, currency and reference. This makes it possible for unauthenticated attackers to have orders marked as paid without paying, or with a cheaper or unrelated Square payment.",
"plugin": {
"slug": "sunshine-photo-cart",
"name": "Sunshine Photo Cart",
"full_name": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers",
"wordpress_org": "https://wordpress.org/plugins/sunshine-photo-cart/",
"advisories_url": "https://wpsec.com/vuln/plugin/sunshine-photo-cart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart"
},
"type": "BYPASS",
"cwe": [
"CWE-345"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8"
]
},
"introduced_in": null,
"fixed_in": "3.8",
"remediation": "Update to 3.8 or later.",
"fix_released": "2026-10-21T20:42:30+00:00",
"published": "2026-10-22T20:45:31+00:00",
"updated": "2026-10-22T11:27:07.799371+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1476/",
"https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/",
"https://wordpress.org/plugins/sunshine-photo-cart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1475",
"url": "https://wpsec.com/vuln/WPSEC-2026-1475/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1475/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1475/index.md",
"title": "Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN",
"description": "The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal (Legacy) IPN handler in all versions up to, and including, 3.7.5, due to the handler completing the order named in the 'custom' field of any PayPal-verified IPN without checking the receiving account, payment status, currency or amount. This makes it possible for unauthenticated attackers to have an order marked as paid by making a much smaller PayPal payment, or a payment to a different PayPal account, that points its notification at the store.",
"plugin": {
"slug": "sunshine-photo-cart",
"name": "Sunshine Photo Cart",
"full_name": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers",
"wordpress_org": "https://wordpress.org/plugins/sunshine-photo-cart/",
"advisories_url": "https://wpsec.com/vuln/plugin/sunshine-photo-cart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart"
},
"type": "BYPASS",
"cwe": [
"CWE-345"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8"
]
},
"introduced_in": null,
"fixed_in": "3.8",
"remediation": "Update to 3.8 or later.",
"fix_released": "2026-10-21T20:42:30+00:00",
"published": "2026-10-22T20:45:31+00:00",
"updated": "2026-10-22T11:27:07.799371+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1475/",
"https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/",
"https://wordpress.org/plugins/sunshine-photo-cart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1474",
"url": "https://wpsec.com/vuln/WPSEC-2026-1474/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1474/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1474/index.md",
"title": "Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion",
"description": "The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Stripe hosted checkout and PayPal (Legacy) cancel handlers in all versions up to, and including, 3.7.5, due to the cancel nonce using one action for every order (and so being the same for all logged-out visitors) and the handlers not checking that the supplied order belongs to the visitor's checkout session or is still unpaid. This makes it possible for unauthenticated attackers to permanently delete arbitrary orders, including paid ones.",
"plugin": {
"slug": "sunshine-photo-cart",
"name": "Sunshine Photo Cart",
"full_name": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers",
"wordpress_org": "https://wordpress.org/plugins/sunshine-photo-cart/",
"advisories_url": "https://wpsec.com/vuln/plugin/sunshine-photo-cart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8"
]
},
"introduced_in": null,
"fixed_in": "3.8",
"remediation": "Update to 3.8 or later.",
"fix_released": "2026-10-21T20:42:30+00:00",
"published": "2026-10-22T20:45:31+00:00",
"updated": "2026-10-22T11:27:07.799371+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1474/",
"https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/",
"https://wordpress.org/plugins/sunshine-photo-cart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1473",
"url": "https://wpsec.com/vuln/WPSEC-2026-1473/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1473/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1473/index.md",
"title": "Paytium: Mollie payment forms & donations <= 5.0.5 - Unauthenticated PHP Object Injection via Payment Form Field Values",
"description": "The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to PHP Object Injection via the pt_form_field payment form parameters (checkbox fields and the pt-uploaded-files key) in all versions up to, and including, 5.0.5, due to deserialization of untrusted input with maybe_unserialize() without restricting allowed classes. This makes it possible for unauthenticated attackers to inject a PHP object. No known POP chain is present in the plugin itself. If a POP chain is present through another plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
"plugin": {
"slug": "paytium",
"name": "Paytium: Mollie payment forms & donations",
"full_name": "Paytium: Mollie payment forms & donations",
"wordpress_org": "https://wordpress.org/plugins/paytium/",
"advisories_url": "https://wpsec.com/vuln/plugin/paytium/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/paytium"
},
"type": "OBJECT INJECTION",
"cwe": [
"CWE-502"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 8.1,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "5.0.6",
"to_inclusive": false
}
],
"text": [
"all versions before 5.0.6"
]
},
"introduced_in": null,
"fixed_in": "5.0.6",
"remediation": "Update to 5.0.6 or later.",
"fix_released": "2026-10-21T19:46:45+00:00",
"published": "2026-10-22T19:48:10+00:00",
"updated": "2026-10-22T09:33:05.997106+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1473/",
"https://plugins.svn.wordpress.org/paytium/tags/5.0.6/",
"https://wordpress.org/plugins/paytium/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/paytium",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1472",
"url": "https://wpsec.com/vuln/WPSEC-2026-1472/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1472/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1472/index.md",
"title": "Webmention <= 5.10.2 - Unauthenticated Server-Side Request Forgery via Webmention Source URL",
"description": "The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery via the webmention endpoint's source URL in all versions up to, and including, 5.10.2. The cause is that when WP_DEBUG is enabled, the plugin hooks 'http_request_args' to set 'reject_unsafe_urls' to false for every outbound HTTP request, which overrides the protection wp_safe_remote_get() gives against private and reserved addresses. Its MF2 URL check also falls back to a format-only test instead of wp_http_validate_url(). This makes it possible for unauthenticated attackers to submit webmentions whose source URLs point at localhost or internal network addresses, so that the site sends requests to internal services and may query or change information on them. Exploitation requires WP_DEBUG to be enabled on the site.",
"plugin": {
"slug": "webmention",
"name": "Webmention",
"full_name": "Webmention",
"wordpress_org": "https://wordpress.org/plugins/webmention/",
"advisories_url": "https://wpsec.com/vuln/plugin/webmention/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/webmention"
},
"type": "SSRF",
"cwe": [
"CWE-918"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "5.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 5.11.0"
]
},
"introduced_in": null,
"fixed_in": "5.11.0",
"remediation": "Update to 5.11.0 or later.",
"fix_released": "2026-10-21T19:36:24+00:00",
"published": "2026-10-22T19:48:10+00:00",
"updated": "2026-10-22T09:33:14.880783+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1472/",
"https://plugins.svn.wordpress.org/webmention/tags/5.11.0/",
"https://wordpress.org/plugins/webmention/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/webmention",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1471",
"url": "https://wpsec.com/vuln/WPSEC-2026-1471/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1471/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1471/index.md",
"title": "Timetics – Appointment Booking Calendar & Scheduling <= 1.0.64 - Unauthenticated Booking Disclosure, Cancellation and Rescheduling via Weak 'appointment_token'",
"description": "The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to authorization bypass via the 'appointment_token' parameter of the /timetics/v1/bookings/{id} REST API endpoint in all versions up to, and including, 1.0.64, due to insufficient entropy in the per-booking security token generated by the generate_security_token() function. The token holds only 32 bits of randomness, is the only check for guest requests, and is used with sequential booking IDs and no rate limiting. This makes it possible for unauthenticated attackers to brute-force the token for a booking and then view its details, including the customer's name, email and phone number, or cancel or reschedule it. The attack needs a very large number of requests.",
"plugin": {
"slug": "timetics",
"name": "Timetics – Appointment Booking Calendar & Scheduling",
"full_name": "Timetics – Appointment Booking Calendar & Scheduling",
"wordpress_org": "https://wordpress.org/plugins/timetics/",
"advisories_url": "https://wpsec.com/vuln/plugin/timetics/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/timetics"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-331"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.0.65",
"to_inclusive": false
}
],
"text": [
"all versions before 1.0.65"
]
},
"introduced_in": null,
"fixed_in": "1.0.65",
"remediation": "Update to 1.0.65 or later.",
"fix_released": "2026-10-21T18:50:42+00:00",
"published": "2026-10-22T19:48:10+00:00",
"updated": "2026-10-22T10:09:35.166594+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1471/",
"https://plugins.svn.wordpress.org/timetics/tags/1.0.65/",
"https://wordpress.org/plugins/timetics/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/timetics",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1470",
"url": "https://wpsec.com/vuln/WPSEC-2026-1470/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1470/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1470/index.md",
"title": "WooCommerce PayPal Payments <= 4.1.3 - Unauthenticated Missing Authorization to Order Processing via Return URL Endpoint",
"description": "The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Missing Authorization via the PayPal return URL endpoint (wc-ajax=ppc-return-url) in all versions up to, and including, 4.1.3, due to the endpoint loading the PayPal order from the 'token' query parameter and running payment processing for the WooCommerce order named in its custom_id without checking that the request came from the checkout session or customer that created it. This makes it possible for unauthenticated attackers who obtain a PayPal order token to trigger payment processing for another customer's WooCommerce order and to learn whether the WooCommerce order behind a token exists.",
"plugin": {
"slug": "woocommerce-paypal-payments",
"name": "WooCommerce PayPal Payments",
"full_name": "WooCommerce PayPal Payments",
"wordpress_org": "https://wordpress.org/plugins/woocommerce-paypal-payments/",
"advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-paypal-payments/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-payments"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.8,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.2.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.2.0"
]
},
"introduced_in": null,
"fixed_in": "4.2.0",
"remediation": "Update to 4.2.0 or later.",
"fix_released": "2026-10-21T16:14:56+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T10:09:17.573876+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1470/",
"https://plugins.svn.wordpress.org/woocommerce-paypal-payments/tags/4.2.0/",
"https://wordpress.org/plugins/woocommerce-paypal-payments/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-paypal-payments",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1469",
"url": "https://wpsec.com/vuln/WPSEC-2026-1469/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1469/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1469/index.md",
"title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via Comment Feeds and Comment Lists",
"description": "The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds and front-end comment lists in all versions up to, and including, 1.6.0. This is due to the plugin only filtering comments on restricted content for REST comment routes, leaving comment feeds and front-end comment queries such as the Recent Comments widget unfiltered. This makes it possible for unauthenticated attackers to read comments posted on restricted pages and posts, along with the titles and permalinks of those restricted items.",
"plugin": {
"slug": "page-and-post-restriction",
"name": "Page and Post Restriction",
"full_name": "Page and Post Restriction",
"wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
"advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.6.1",
"to_inclusive": false
}
],
"text": [
"all versions before 1.6.1"
]
},
"introduced_in": null,
"fixed_in": "1.6.1",
"remediation": "Update to 1.6.1 or later.",
"fix_released": "2026-10-21T16:13:57+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:17.174410+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1469/",
"https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
"https://wordpress.org/plugins/page-and-post-restriction/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1468",
"url": "https://wpsec.com/vuln/WPSEC-2026-1468/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1468/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1468/index.md",
"title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via Role-Restricted Pages and Posts",
"description": "The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass in all versions up to, and including, 1.6.0. This is due to the front-end restriction logic only blocking guests when the 'Require Login' option was set, so pages and posts configured with role-based restrictions but without 'Require Login' were not protected from logged-out visitors. This makes it possible for unauthenticated attackers to view pages and posts that were meant to be limited to specific user roles, when such a restriction is configured.",
"plugin": {
"slug": "page-and-post-restriction",
"name": "Page and Post Restriction",
"full_name": "Page and Post Restriction",
"wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
"advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-863"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.6.1",
"to_inclusive": false
}
],
"text": [
"all versions before 1.6.1"
]
},
"introduced_in": null,
"fixed_in": "1.6.1",
"remediation": "Update to 1.6.1 or later.",
"fix_released": "2026-10-21T16:13:57+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:17.174410+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1468/",
"https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
"https://wordpress.org/plugins/page-and-post-restriction/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1467",
"url": "https://wpsec.com/vuln/WPSEC-2026-1467/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1467/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1467/index.md",
"title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint",
"description": "The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure via the oEmbed endpoint in all versions up to, and including, 1.6.0. This is due to the plugin not applying its restriction checks to the /oembed/1.0/embed REST endpoint or to internal embeds through the oembed_request_post_id filter. This makes it possible for unauthenticated attackers to get the title, author name and embed markup of restricted pages and posts.",
"plugin": {
"slug": "page-and-post-restriction",
"name": "Page and Post Restriction",
"full_name": "Page and Post Restriction",
"wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
"advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.6.1",
"to_inclusive": false
}
],
"text": [
"all versions before 1.6.1"
]
},
"introduced_in": null,
"fixed_in": "1.6.1",
"remediation": "Update to 1.6.1 or later.",
"fix_released": "2026-10-21T16:13:57+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:17.174410+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1467/",
"https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
"https://wordpress.org/plugins/page-and-post-restriction/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1466",
"url": "https://wpsec.com/vuln/WPSEC-2026-1466/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1466/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1466/index.md",
"title": "Page and Post Restriction <= 1.6.0 - Unauthenticated Restricted Content Access Bypass via REST API 'id' Parameter",
"description": "The Page and Post Restriction plugin for WordPress is vulnerable to an access restriction bypass via the REST API in all versions up to, and including, 1.6.0. This is due to the REST restriction check only validating the post or comment ID in the route path, while WordPress lets a query-string or body 'id' parameter override the route ID and matches routes case-insensitively. This makes it possible for unauthenticated attackers to read the content of restricted pages and posts, and comments on them, by requesting an accessible item's endpoint with the restricted item's ID in the 'id' parameter or by using a differently-cased route.",
"plugin": {
"slug": "page-and-post-restriction",
"name": "Page and Post Restriction",
"full_name": "Page and Post Restriction",
"wordpress_org": "https://wordpress.org/plugins/page-and-post-restriction/",
"advisories_url": "https://wpsec.com/vuln/plugin/page-and-post-restriction/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-863"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.6.1",
"to_inclusive": false
}
],
"text": [
"all versions before 1.6.1"
]
},
"introduced_in": null,
"fixed_in": "1.6.1",
"remediation": "Update to 1.6.1 or later.",
"fix_released": "2026-10-21T16:13:57+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:17.174410+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1466/",
"https://plugins.svn.wordpress.org/page-and-post-restriction/tags/1.6.1/",
"https://wordpress.org/plugins/page-and-post-restriction/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/page-and-post-restriction",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1465",
"url": "https://wpsec.com/vuln/WPSEC-2026-1465/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1465/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1465/index.md",
"title": "Go Fetch Jobs (for WP Job Manager) <= 1.8.5.2 - Authenticated (Subscriber+) Missing Authorization to Feed Import and Template Actions",
"description": "The Go Fetch Jobs (for WP Job Manager) plugin for WordPress is vulnerable to unauthorized access via several AJAX actions (goft_wpjm_load_template_content, goft_wpjm_update_templates_list, goft_wpjm_load_provider_info, goft_wpjm_import_feed and goft_wpjm_toggle_settings) in all versions up to, and including, 1.8.5.2, due to a missing capability check. The handlers only verify the goft_wpjm_nonce nonce, and that nonce is printed on any admin page loaded with the plugin's post_type query parameter, so any logged-in user can obtain it. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the site's saved import templates and their settings, list template names, make the server fetch and parse remote or uploaded job feeds, and overwrite the plugin's cached feed items.",
"plugin": {
"slug": "go-fetch-jobs-wp-job-manager",
"name": "Go Fetch Jobs (for WP Job Manager)",
"full_name": "Go Fetch Jobs (for WP Job Manager)",
"wordpress_org": "https://wordpress.org/plugins/go-fetch-jobs-wp-job-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/go-fetch-jobs-wp-job-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/go-fetch-jobs-wp-job-manager"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.0.2.1",
"to_inclusive": false
}
],
"text": [
"all versions before 2.0.2.1"
]
},
"introduced_in": null,
"fixed_in": "2.0.2.1",
"remediation": "Update to 2.0.2.1 or later.",
"fix_released": "2026-10-21T16:09:56+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:28.996962+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1465/",
"https://plugins.svn.wordpress.org/go-fetch-jobs-wp-job-manager/tags/2.0.2.1/",
"https://wordpress.org/plugins/go-fetch-jobs-wp-job-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/go-fetch-jobs-wp-job-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1464",
"url": "https://wpsec.com/vuln/WPSEC-2026-1464/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1464/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1464/index.md",
"title": "Advanced Form Integration <= 2.10.3 - Unauthenticated Arbitrary Shortcode Execution via Form Submission Values",
"description": "The Advanced Form Integration plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via form submission values in all versions up to, and including, 2.10.3. This is due to the adfoin_get_parsed_values() function substituting user-submitted form values into integration field templates and then passing the result to do_shortcode() without neutralizing square brackets in those values. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting them through a front-end form that is connected to an active integration, which may trigger side effects or expose data through shortcodes registered by other plugins.",
"plugin": {
"slug": "advanced-form-integration",
"name": "Advanced Form Integration",
"full_name": "Advanced Form Integration — Connect Forms to 300+ Apps",
"wordpress_org": "https://wordpress.org/plugins/advanced-form-integration/",
"advisories_url": "https://wpsec.com/vuln/plugin/advanced-form-integration/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-form-integration"
},
"type": "UNKNOWN",
"cwe": [
"CWE-94"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.10.4",
"to_inclusive": false
}
],
"text": [
"all versions before 2.10.4"
]
},
"introduced_in": null,
"fixed_in": "2.10.4",
"remediation": "Update to 2.10.4 or later.",
"fix_released": "2026-10-21T16:04:41+00:00",
"published": "2026-10-22T16:48:21+00:00",
"updated": "2026-10-22T09:33:12.711059+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1464/",
"https://plugins.svn.wordpress.org/advanced-form-integration/tags/2.10.4/",
"https://wordpress.org/plugins/advanced-form-integration/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-form-integration",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1463",
"url": "https://wpsec.com/vuln/WPSEC-2026-1463/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1463/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1463/index.md",
"title": "GeoDirectory <= 2.8.194 - Authenticated (Subscriber+) Missing Authorization to Listing Status, Featured Flag, Expiry and Package Modification",
"description": "The GeoDirectory plugin for WordPress is vulnerable to unauthorized modification of listing data via the frontend listing auto-save and save AJAX handlers in all versions up to, and including, 2.8.194, due to the plugin passing the raw request to wp_update_post() and the listing save routine without removing protected fields such as 'post_status', 'featured', 'expire_date' and 'package_id' for non-administrative users. This makes it possible for authenticated attackers, with subscriber-level access and above (or unauthenticated visitors where guest listing submission is enabled), to publish their own pending listings without moderation and mark their listings as featured. Where a pricing add-on is in use, they can also change listing expiry dates or switch packages.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-915"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.195",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.195"
]
},
"introduced_in": null,
"fixed_in": "2.8.195",
"remediation": "Update to 2.8.195 or later.",
"fix_released": "2026-10-21T15:24:54+00:00",
"published": "2026-10-22T15:43:48+00:00",
"updated": "2026-10-22T11:27:05.318127+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1463/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.195/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1462",
"url": "https://wpsec.com/vuln/WPSEC-2026-1462/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1462/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1462/index.md",
"title": "GeoDirectory <= 2.8.194 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Badge Shortcode 'cta' and 'link' Attributes",
"description": "The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'cta' attributes of the gd_post_badge shortcode in all versions up to, and including, 2.8.194, due to insufficient output escaping. The 'link' value is placed in a single-quoted href inside popover HTML using esc_url(), which encodes quotes only as HTML entities that are decoded again when the popover is rendered as unsanitized HTML. The 'cta' value is placed in an onclick JavaScript string without its entities being decoded first. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.195",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.195"
]
},
"introduced_in": null,
"fixed_in": "2.8.195",
"remediation": "Update to 2.8.195 or later.",
"fix_released": "2026-10-21T15:24:54+00:00",
"published": "2026-10-22T15:43:48+00:00",
"updated": "2026-10-22T11:27:05.318127+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1462/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.195/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1461",
"url": "https://wpsec.com/vuln/WPSEC-2026-1461/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1461/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1461/index.md",
"title": "Quote for WooCommerce Lite <= 1.5.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quote Details Disclosure",
"description": "The B2B Request a Quote plugin for WordPress is vulnerable to Insecure Direct Object Reference via the My Account 'my-quotes' endpoint in all versions up to, and including, 1.5.7, due to the quote details view rendering any quote by its user-supplied ID without verifying that the current user owns the quote. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the details of quotes submitted by other customers, including the quoted products, SKUs, quantities, prices, totals and quote date.",
"plugin": {
"slug": "woo-add-to-quote",
"name": "Quote for WooCommerce Lite",
"full_name": "B2B Request a Quote",
"wordpress_org": "https://wordpress.org/plugins/woo-add-to-quote/",
"advisories_url": "https://wpsec.com/vuln/plugin/woo-add-to-quote/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/woo-add-to-quote"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.5.8",
"to_inclusive": false
}
],
"text": [
"all versions before 1.5.8"
]
},
"introduced_in": null,
"fixed_in": "1.5.8",
"remediation": "Update to 1.5.8 or later.",
"fix_released": "2026-10-21T14:27:05+00:00",
"published": "2026-10-22T14:52:34+00:00",
"updated": "2026-10-22T09:33:24.659965+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1461/",
"https://plugins.svn.wordpress.org/woo-add-to-quote/tags/1.5.8/",
"https://wordpress.org/plugins/woo-add-to-quote/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-add-to-quote",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1460",
"url": "https://wpsec.com/vuln/WPSEC-2026-1460/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1460/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1460/index.md",
"title": "Post to Google My Business (Google Business Profile) <= 3.4.4 - Authenticated (Subscriber+) Missing Authorization to Freemius Opt-In",
"description": "The Post to Google My Business (Google Business Profile) plugin for WordPress is vulnerable to unauthorized access via the bundled Freemius SDK's _install_with_new_user() opt-in handler in all versions up to, and including, 3.4.4, due to a missing capability check. The handler runs during admin_menu on any wp-admin page, and its nonce check is commented out. This makes it possible for authenticated attackers, with Subscriber-level access and above, to complete the Freemius opt-in for a site that is not yet connected. The attacker supplies the user and install identifiers and keys, which links the site's Freemius install to an account the attacker controls, or puts the site into a pending activation confirmation state for an email address the attacker chooses.",
"plugin": {
"slug": "post-to-google-my-business",
"name": "Post to Google My Business (Google Business Profile)",
"full_name": "Post to Google My Business (Google Business Profile)",
"wordpress_org": "https://wordpress.org/plugins/post-to-google-my-business/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-to-google-my-business/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-to-google-my-business"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.5.4",
"to_inclusive": false
}
],
"text": [
"all versions before 3.5.4"
]
},
"introduced_in": null,
"fixed_in": "3.5.4",
"remediation": "Update to 3.5.4 or later.",
"fix_released": "2026-10-21T14:21:30+00:00",
"published": "2026-10-22T14:52:34+00:00",
"updated": "2026-10-22T09:33:19.596514+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1460/",
"https://plugins.svn.wordpress.org/post-to-google-my-business/tags/3.5.4/",
"https://wordpress.org/plugins/post-to-google-my-business/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-to-google-my-business",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1459",
"url": "https://wpsec.com/vuln/WPSEC-2026-1459/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1459/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1459/index.md",
"title": "Easy Appointments <= 4.0.3 - Unauthenticated Authentication Bypass via Forgeable Legacy Appointment Action Token",
"description": "The Easy Appointments plugin for WordPress is vulnerable to authentication bypass via the email action links (confirm/cancel) in version 4.0.3, due to a backward-compatible token fallback in validate_token() that accepts an MD5 hash of a salt hardcoded in the plugin, the appointment's creation timestamp and the action, with no limit on failed attempts. This makes it possible for unauthenticated attackers who know or guess an appointment ID and its creation time to forge valid tokens and confirm or cancel other customers' appointments.",
"plugin": {
"slug": "easy-appointments",
"name": "Easy Appointments",
"full_name": "Easy Appointments",
"wordpress_org": "https://wordpress.org/plugins/easy-appointments/",
"advisories_url": "https://wpsec.com/vuln/plugin/easy-appointments/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/easy-appointments"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-330"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": "4.0.3",
"from_inclusive": true,
"to": "4.0.4",
"to_inclusive": false
}
],
"text": [
"from 4.0.3 before 4.0.4"
]
},
"introduced_in": "4.0.3",
"fixed_in": "4.0.4",
"remediation": "Update to 4.0.4 or later.",
"fix_released": "2026-10-21T13:27:17+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T10:09:29.696908+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1459/",
"https://plugins.svn.wordpress.org/easy-appointments/tags/4.0.4/",
"https://wordpress.org/plugins/easy-appointments/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-appointments",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1458",
"url": "https://wpsec.com/vuln/WPSEC-2026-1458/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1458/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1458/index.md",
"title": "Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email",
"description": "The Easy Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ea_get_customer_detail and ea_search_customers AJAX actions in all versions up to, and including, 4.0.3. When a booking is completed, the plugin adds the current user's ID to any existing customer record whose email matches the booking email, without checking that the user owns that email. The customer detail and search endpoints then trust that link for authorization. This makes it possible for authenticated attackers, with subscriber-level access and above, to make a booking with a victim's email address and then read the victim's customer record, including name, email address, phone number and address.",
"plugin": {
"slug": "easy-appointments",
"name": "Easy Appointments",
"full_name": "Easy Appointments",
"wordpress_org": "https://wordpress.org/plugins/easy-appointments/",
"advisories_url": "https://wpsec.com/vuln/plugin/easy-appointments/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/easy-appointments"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.0.4",
"to_inclusive": false
}
],
"text": [
"all versions before 4.0.4"
]
},
"introduced_in": null,
"fixed_in": "4.0.4",
"remediation": "Update to 4.0.4 or later.",
"fix_released": "2026-10-21T13:27:17+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T10:09:29.696908+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1458/",
"https://plugins.svn.wordpress.org/easy-appointments/tags/4.0.4/",
"https://wordpress.org/plugins/easy-appointments/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-appointments",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1457",
"url": "https://wpsec.com/vuln/WPSEC-2026-1457/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1457/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1457/index.md",
"title": "WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download",
"description": "The Contact Forms by Cimatti plugin for WordPress is vulnerable to Insecure Direct Object Reference via the accua_forms_download_submitted_file AJAX action in all versions up to, and including, 2.3.6, due to downloads being authorized by a generic 'accua_forms_download_nonce' nonce instead of the submission's own secret token. For logged-out visitors this nonce is the same for everyone, and the plugin puts it into every file download link it builds while processing a submission. This makes it possible for unauthenticated attackers who receive such a link for their own submission, for example in an autoreply e-mail or success message that includes the submitted data, to download files uploaded with other visitors' submissions by changing the sequential submission ID, the field and the file name in the URL.",
"plugin": {
"slug": "contact-forms",
"name": "WordPress Contact Forms by Cimatti",
"full_name": "Contact Forms by Cimatti",
"wordpress_org": "https://wordpress.org/plugins/contact-forms/",
"advisories_url": "https://wpsec.com/vuln/plugin/contact-forms/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/contact-forms"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.3.32",
"to_inclusive": false
}
],
"text": [
"all versions before 2.3.32"
]
},
"introduced_in": null,
"fixed_in": "2.3.32",
"remediation": "Update to 2.3.32 or later.",
"fix_released": "2026-10-21T13:26:58+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T09:33:22.530958+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1457/",
"https://plugins.svn.wordpress.org/contact-forms/tags/2.3.32/",
"https://wordpress.org/plugins/contact-forms/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-forms",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1456",
"url": "https://wpsec.com/vuln/WPSEC-2026-1456/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1456/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1456/index.md",
"title": "Post Carousel <= 4.0.8 - Authenticated (Contributor+) Sensitive Information Exposure via Saved Template Shortcode",
"description": "The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the [smart_post] saved template shortcode in all versions from 4.0.0 up to, and including, 4.0.8. This is due to the shortcode rendering the post_content of any published post ID without checking that the post is a saved template (sp_post_template) or that it is not password protected. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the content of password-protected posts and of published entries of other post types when the Saved Templates module is enabled.",
"plugin": {
"slug": "post-carousel",
"name": "Post Carousel",
"full_name": "Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News",
"wordpress_org": "https://wordpress.org/plugins/post-carousel/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-carousel/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-carousel"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "4.0.0",
"from_inclusive": true,
"to": "4.0.9",
"to_inclusive": false
}
],
"text": [
"from 4.0.0 before 4.0.9"
]
},
"introduced_in": "4.0.0",
"fixed_in": "4.0.9",
"remediation": "Update to 4.0.9 or later.",
"fix_released": "2026-10-21T13:06:12+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T11:27:03.086777+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1456/",
"https://plugins.svn.wordpress.org/post-carousel/tags/4.0.9/",
"https://wordpress.org/plugins/post-carousel/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-carousel",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1455",
"url": "https://wpsec.com/vuln/WPSEC-2026-1455/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1455/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1455/index.md",
"title": "Post Carousel <= 4.0.8 - Unauthenticated Password-Protected Post Content and Non-Public Post Disclosure via sp_smart_post_block_all_post_query AJAX Action",
"description": "The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the sp_smart_post_block_all_post_query AJAX action in all versions from 4.0.0 up to, and including, 4.0.8. This is due to the action being registered for unauthenticated users with no capability check, accepting arbitrary post types, and returning complete WP_Post objects, including the post_content and post_password fields. The nonce it checks is printed on front-end pages that contain the plugin's blocks. This makes it possible for unauthenticated attackers to read the content and stored passwords of password-protected published posts, and the published entries of non-public post types.",
"plugin": {
"slug": "post-carousel",
"name": "Post Carousel",
"full_name": "Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News",
"wordpress_org": "https://wordpress.org/plugins/post-carousel/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-carousel/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-carousel"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "4.0.0",
"from_inclusive": true,
"to": "4.0.9",
"to_inclusive": false
}
],
"text": [
"from 4.0.0 before 4.0.9"
]
},
"introduced_in": "4.0.0",
"fixed_in": "4.0.9",
"remediation": "Update to 4.0.9 or later.",
"fix_released": "2026-10-21T13:06:12+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T11:27:03.086777+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1455/",
"https://plugins.svn.wordpress.org/post-carousel/tags/4.0.9/",
"https://wordpress.org/plugins/post-carousel/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-carousel",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1454",
"url": "https://wpsec.com/vuln/WPSEC-2026-1454/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1454/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1454/index.md",
"title": "Post Carousel <= 4.0.8 - Unauthenticated Non-Public Post Type Information Exposure via Smart Search REST Endpoint",
"description": "The Smart Post plugin for WordPress is vulnerable to Sensitive Information Exposure via the sps-blocks/v2/smart-search REST endpoint and the sp_smart_post_block_post_query AJAX action in all versions from 4.0.0 up to, and including, 4.0.8. This is due to these post queries using a request-supplied post type without restricting it to public post types. This makes it possible for unauthenticated attackers to retrieve titles, excerpts, authors and other details of published entries of non-public post types, such as WooCommerce coupons or other plugins' internal records.",
"plugin": {
"slug": "post-carousel",
"name": "Post Carousel",
"full_name": "Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News",
"wordpress_org": "https://wordpress.org/plugins/post-carousel/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-carousel/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-carousel"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "4.0.0",
"from_inclusive": true,
"to": "4.0.9",
"to_inclusive": false
}
],
"text": [
"from 4.0.0 before 4.0.9"
]
},
"introduced_in": "4.0.0",
"fixed_in": "4.0.9",
"remediation": "Update to 4.0.9 or later.",
"fix_released": "2026-10-21T13:06:12+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T11:27:03.086777+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1454/",
"https://plugins.svn.wordpress.org/post-carousel/tags/4.0.9/",
"https://wordpress.org/plugins/post-carousel/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-carousel",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1453",
"url": "https://wpsec.com/vuln/WPSEC-2026-1453/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1453/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1453/index.md",
"title": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Trashing via 'buycred-cancel' Parameter",
"description": "The myCred plugin for WordPress is vulnerable to Insecure Direct Object Reference via the buyCRED pending payment cancellation handler in all versions up to, and including, 3.2.6, due to the 'buycred-cancel' value being checked only against a generic nonce that is not tied to a specific payment, with no check that the current user owns the referenced payment and no check of its post type. This makes it possible for authenticated attackers with Subscriber-level access and above, who get a cancellation nonce (for example from a cancel link for their own buyCRED payment), to move other users' pending buyCRED payments, as well as any other post or page identified by a numeric ID, to the trash.",
"plugin": {
"slug": "mycred",
"name": "myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program",
"full_name": "Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred",
"wordpress_org": "https://wordpress.org/plugins/mycred/",
"advisories_url": "https://wpsec.com/vuln/plugin/mycred/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/mycred"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.0.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.0.0"
]
},
"introduced_in": null,
"fixed_in": "4.0.0",
"remediation": "Update to 4.0.0 or later.",
"fix_released": "2026-10-21T13:05:40+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T09:32:56.128011+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1453/",
"https://plugins.svn.wordpress.org/mycred/tags/4.0.0/",
"https://wordpress.org/plugins/mycred/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/mycred",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1452",
"url": "https://wpsec.com/vuln/WPSEC-2026-1452/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1452/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1452/index.md",
"title": "Fattura24 <= 8.2.0 - Missing Authorization to Unauthenticated Support Ticket Submission",
"description": "The Fattura24 plugin for WordPress is vulnerable to unauthorized access via the Support tab ticket handler in all versions up to, and including, 8.2.0, due to a missing capability check (and missing nonce) in the fatt_24_get_ticket_data function. That function is hooked to an init-time WooCommerce action and handles any POST request with the 'invia' parameter. This makes it possible for unauthenticated attackers to make the site send support requests to Fattura24's help desk in the site's name. These requests use an attacker-chosen reply-to address and include the plugin settings, environment information and the data of any order the attacker names.",
"plugin": {
"slug": "fattura24",
"name": "Fattura24",
"full_name": "Fattura24",
"wordpress_org": "https://wordpress.org/plugins/fattura24/",
"advisories_url": "https://wpsec.com/vuln/plugin/fattura24/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/fattura24"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "8.2.1",
"to_inclusive": false
}
],
"text": [
"all versions before 8.2.1"
]
},
"introduced_in": null,
"fixed_in": "8.2.1",
"remediation": "Update to 8.2.1 or later.",
"fix_released": "2026-10-21T12:59:56+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T09:33:10.493592+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1452/",
"https://plugins.svn.wordpress.org/fattura24/tags/8.2.1/",
"https://wordpress.org/plugins/fattura24/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/fattura24",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1451",
"url": "https://wpsec.com/vuln/WPSEC-2026-1451/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1451/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1451/index.md",
"title": "Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File",
"description": "The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via the support ticket attachment in all versions up to, and including, 8.2.0, due to the fatt_24_send_ticket function writing the ticket content into the web-accessible plugin directory under a predictable name (source, account ID and timestamp). The file includes the plugin settings, which hold the API key, and order data. It is deleted only after the remote request finishes. This makes it possible for unauthenticated attackers who can predict the file name to read the API key and customer order data while the file exists.",
"plugin": {
"slug": "fattura24",
"name": "Fattura24",
"full_name": "Fattura24",
"wordpress_org": "https://wordpress.org/plugins/fattura24/",
"advisories_url": "https://wpsec.com/vuln/plugin/fattura24/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/fattura24"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-377"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "8.2.1",
"to_inclusive": false
}
],
"text": [
"all versions before 8.2.1"
]
},
"introduced_in": null,
"fixed_in": "8.2.1",
"remediation": "Update to 8.2.1 or later.",
"fix_released": "2026-10-21T12:59:56+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T09:33:10.493592+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1451/",
"https://plugins.svn.wordpress.org/fattura24/tags/8.2.1/",
"https://wordpress.org/plugins/fattura24/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/fattura24",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1450",
"url": "https://wpsec.com/vuln/WPSEC-2026-1450/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1450/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1450/index.md",
"title": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund",
"description": "The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the wps_wallet_refund_partial_payment AJAX action in all versions up to, and including, 2.8.1, due to missing nonce validation and no check on whether an order's partial payment was already refunded. This makes it possible for unauthenticated attackers to credit an order's partial wallet payment back to the customer's wallet, as many times as they like, by tricking a shop manager or administrator into performing an action such as clicking a link.",
"plugin": {
"slug": "wallet-system-for-woocommerce",
"name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
"full_name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
"wordpress_org": "https://wordpress.org/plugins/wallet-system-for-woocommerce/",
"advisories_url": "https://wpsec.com/vuln/plugin/wallet-system-for-woocommerce/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce"
},
"type": "CSRF",
"cwe": [
"CWE-352"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.2",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.2"
]
},
"introduced_in": null,
"fixed_in": "2.8.2",
"remediation": "Update to 2.8.2 or later.",
"fix_released": "2026-10-21T12:55:26+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T11:27:10.865378+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1450/",
"https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.2/",
"https://wordpress.org/plugins/wallet-system-for-woocommerce/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1449",
"url": "https://wpsec.com/vuln/WPSEC-2026-1449/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1449/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1449/index.md",
"title": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Authenticated (Subscriber+) Comment Reward Limit Bypass",
"description": "The Wallet System for WooCommerce plugin for WordPress is vulnerable to a business logic flaw via the comment (product review) wallet reward feature in all versions up to, and including, 2.8.1. Auto-approved comments are checked against the per-post reward limit using a WooCommerce session snapshot taken when the comment form was rendered, and comments approved later by a moderator are not checked against the limit at all. This makes it possible for authenticated attackers, with subscriber-level access and above, to collect wallet credit for more comments than the configured limit allows when comment rewards are enabled.",
"plugin": {
"slug": "wallet-system-for-woocommerce",
"name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
"full_name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
"wordpress_org": "https://wordpress.org/plugins/wallet-system-for-woocommerce/",
"advisories_url": "https://wpsec.com/vuln/plugin/wallet-system-for-woocommerce/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce"
},
"type": "BYPASS",
"cwe": [
"CWE-840"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.2",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.2"
]
},
"introduced_in": null,
"fixed_in": "2.8.2",
"remediation": "Update to 2.8.2 or later.",
"fix_released": "2026-10-21T12:55:26+00:00",
"published": "2026-10-22T13:52:08+00:00",
"updated": "2026-10-22T11:27:10.865378+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1449/",
"https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.2/",
"https://wordpress.org/plugins/wallet-system-for-woocommerce/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1448",
"url": "https://wpsec.com/vuln/WPSEC-2026-1448/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1448/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1448/index.md",
"title": "Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Missing Authorization to Integration Settings Modification and Provider Migration",
"description": "The Hustle plugin for WordPress is vulnerable to unauthorized access and modification of data via several integration AJAX actions in all versions up to, and including, 7.8.14.3, due to missing capability checks in get_addons, get_form_addons, refresh_email_lists, form_settings, form_deactivate, insert_local_list, is_on_module and the migrate_* provider migration handlers. These handlers only verified a nonce, and that nonce is printed for any user who can open a Hustle module editor. This makes it possible for authenticated attackers who have been granted access to edit at least one Hustle module to change the integration settings of modules they are not allowed to edit, and to replace global provider API credentials through the migration handlers without the Integrations permission.",
"plugin": {
"slug": "wordpress-popup",
"name": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
"full_name": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
"wordpress_org": "https://wordpress.org/plugins/wordpress-popup/",
"advisories_url": "https://wpsec.com/vuln/plugin/wordpress-popup/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wordpress-popup"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.8.14.4",
"to_inclusive": false
}
],
"text": [
"all versions before 7.8.14.4"
]
},
"introduced_in": null,
"fixed_in": "7.8.14.4",
"remediation": "Update to 7.8.14.4 or later.",
"fix_released": "2026-10-21T12:37:48+00:00",
"published": "2026-10-22T12:44:26+00:00",
"updated": "2026-10-22T11:27:13.046750+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1448/",
"https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.4/",
"https://wordpress.org/plugins/wordpress-popup/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wordpress-popup",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1447",
"url": "https://wpsec.com/vuln/WPSEC-2026-1447/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1447/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1447/index.md",
"title": "Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.3 - Authenticated (Custom-Access+) Stored Cross-Site Scripting via CTA Button Label and Module Title",
"description": "The Hustle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the module CTA button label and the module title in all versions up to, and including, 7.8.14.3, due to stripcslashes() being applied to the CTA label after it was sanitized with wp_kses, and to the module title being placed in the wrapper aria-label attribute without escaping. This makes it possible for authenticated attackers who have been granted access to edit Hustle modules to inject arbitrary web scripts in pages that execute whenever a user accesses a page displaying the module.",
"plugin": {
"slug": "wordpress-popup",
"name": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
"full_name": "Hustle – Email Marketing, Lead Generation, Optins, Popups",
"wordpress_org": "https://wordpress.org/plugins/wordpress-popup/",
"advisories_url": "https://wpsec.com/vuln/plugin/wordpress-popup/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wordpress-popup"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.8.14.4",
"to_inclusive": false
}
],
"text": [
"all versions before 7.8.14.4"
]
},
"introduced_in": null,
"fixed_in": "7.8.14.4",
"remediation": "Update to 7.8.14.4 or later.",
"fix_released": "2026-10-21T12:37:48+00:00",
"published": "2026-10-22T12:44:26+00:00",
"updated": "2026-10-22T11:27:13.046750+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1447/",
"https://plugins.svn.wordpress.org/wordpress-popup/tags/7.8.14.4/",
"https://wordpress.org/plugins/wordpress-popup/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wordpress-popup",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1446",
"url": "https://wpsec.com/vuln/WPSEC-2026-1446/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1446/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1446/index.md",
"title": "ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.4 - Authenticated (Subscriber+) PHP Object Injection via Profile Field Values",
"description": "The User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.0.0.4 due to deserialization of user-controlled profile field meta values with maybe_unserialize() when profiles and custom fields are rendered. This makes it possible for authenticated attackers, with subscriber-level access and above, to store a serialized string in their profile fields and inject a PHP object when the profile is displayed. No known POP chain is present in the plugin itself, but if one is available via another installed plugin or theme, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
"plugin": {
"slug": "profilegrid-user-profiles-groups-and-communities",
"name": "ProfileGrid – User Profiles, Groups and Communities",
"full_name": "ProfileGrid – User Profiles, Groups and Communities",
"wordpress_org": "https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/",
"advisories_url": "https://wpsec.com/vuln/plugin/profilegrid-user-profiles-groups-and-communities/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/profilegrid-user-profiles-groups-and-communities"
},
"type": "OBJECT INJECTION",
"cwe": [
"CWE-502"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.5,
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "6.0.0.5",
"to_inclusive": false
}
],
"text": [
"all versions before 6.0.0.5"
]
},
"introduced_in": null,
"fixed_in": "6.0.0.5",
"remediation": "Update to 6.0.0.5 or later.",
"fix_released": "2026-10-21T11:54:21+00:00",
"published": "2026-10-22T12:44:26+00:00",
"updated": "2026-10-22T11:27:19.376056+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1446/",
"https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.5/",
"https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/profilegrid-user-profiles-groups-and-communities",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1445",
"url": "https://wpsec.com/vuln/WPSEC-2026-1445/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1445/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1445/index.md",
"title": "Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title",
"description": "The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mapped Contact Form 7 form titles in all versions up to, and including, 1.8.2.4 due to insufficient output escaping. The plugin's forms page placed the titles into the inline click handlers of the Edit and Delete links with JavaScript-only escaping, which does not stop a double quote from ending the string once the browser decodes the attribute, and inserted them unescaped into the HTML of the delete confirmation dialog. This makes it possible for authenticated attackers who can edit Contact Form 7 forms (Editor-level access and above by default) to inject arbitrary web scripts that execute when an administrator clicks the Edit or Delete link of the mapped form on the plugin's forms page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "zoho-crm-forms",
"name": "Zoho CRM Lead Magnet",
"full_name": "Zoho CRM Lead Magnet",
"wordpress_org": "https://wordpress.org/plugins/zoho-crm-forms/",
"advisories_url": "https://wpsec.com/vuln/plugin/zoho-crm-forms/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.0,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.2.5",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.2.5"
]
},
"introduced_in": null,
"fixed_in": "1.8.2.5",
"remediation": "Update to 1.8.2.5 or later.",
"fix_released": "2026-10-21T11:17:37+00:00",
"published": "2026-10-22T11:46:43+00:00",
"updated": "2026-10-21T13:26:45.756419+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1445/",
"https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.5/",
"https://wordpress.org/plugins/zoho-crm-forms/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1444",
"url": "https://wpsec.com/vuln/WPSEC-2026-1444/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1444/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1444/index.md",
"title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_rsvp_date' Parameter",
"description": "The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event_rsvp_date' parameter in all versions up to, and including, 7.4.8 due to insufficient input sanitization (only wp_kses_data was applied) and missing output escaping when the value is printed into an input attribute of the event bookings form. This makes it possible for authenticated attackers, with contributor-level access and above who can edit events, to inject arbitrary web scripts that execute whenever a user accesses the event editing form.",
"plugin": {
"slug": "events-manager",
"name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"wordpress_org": "https://wordpress.org/plugins/events-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.4.9",
"to_inclusive": false
}
],
"text": [
"all versions before 7.4.9"
]
},
"introduced_in": null,
"fixed_in": "7.4.9",
"remediation": "Update to 7.4.9 or later.",
"fix_released": "2026-10-21T10:44:10+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T13:33:33.452941+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1444/",
"https://plugins.svn.wordpress.org/events-manager/tags/7.4.9/",
"https://wordpress.org/plugins/events-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1443",
"url": "https://wpsec.com/vuln/WPSEC-2026-1443/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1443/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1443/index.md",
"title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_search_form Shortcode Label Attributes",
"description": "The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tags_label', 'tag_label', 'categories_label' and 'category_label' attributes of the event_search_form (events_search) shortcode in versions 6.4.7 up to, and including, 7.4.8. This is due to insufficient output escaping: the search form tag and category templates print these values into data-default and data-label HTML attributes without escaping them. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.",
"plugin": {
"slug": "events-manager",
"name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"wordpress_org": "https://wordpress.org/plugins/events-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "6.4.7",
"from_inclusive": true,
"to": "7.4.9",
"to_inclusive": false
}
],
"text": [
"from 6.4.7 before 7.4.9"
]
},
"introduced_in": "6.4.7",
"fixed_in": "7.4.9",
"remediation": "Update to 7.4.9 or later.",
"fix_released": "2026-10-21T10:44:10+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T13:33:33.452941+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1443/",
"https://plugins.svn.wordpress.org/events-manager/tags/7.4.9/",
"https://wordpress.org/plugins/events-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1442",
"url": "https://wpsec.com/vuln/WPSEC-2026-1442/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1442/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1442/index.md",
"title": "Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Booking Approval Bypass and Authenticated (Subscriber+) Arbitrary Booking Cancellation via 'booking_id' Parameter Mass Assignment",
"description": "The Events Manager plugin for WordPress is vulnerable to improperly controlled modification of object attributes via the 'booking_id' parameter in all versions up to, and including, 7.4.8. This is due to the booking action handlers passing the raw request value to em_get_booking() without checking that it is a numeric ID or a booking UUID. When an array is supplied, its keys are assigned to the database fields of a booking object, such as the booking's ID, event, owner and status, and the permission checks then run against these supplied values instead of the stored booking. This makes it possible for unauthenticated attackers, when guest bookings are enabled (the default), to create bookings that are already approved, bypassing manual booking approval; for authenticated attackers with subscriber-level access and above to cancel other users' bookings when booking cancellation is enabled (the default); and for authenticated attackers with contributor-level access and above, who can manage bookings by default, to approve, reject or delete any booking on the site.",
"plugin": {
"slug": "events-manager",
"name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"full_name": "Events Manager – Calendar, Bookings, Tickets, Appointments and more!",
"wordpress_org": "https://wordpress.org/plugins/events-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/events-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/events-manager"
},
"type": "BYPASS",
"cwe": [
"CWE-915"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.4.9",
"to_inclusive": false
}
],
"text": [
"all versions before 7.4.9"
]
},
"introduced_in": null,
"fixed_in": "7.4.9",
"remediation": "Update to 7.4.9 or later.",
"fix_released": "2026-10-21T10:44:10+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T13:33:33.452941+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1442/",
"https://plugins.svn.wordpress.org/events-manager/tags/7.4.9/",
"https://wordpress.org/plugins/events-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1441",
"url": "https://wpsec.com/vuln/WPSEC-2026-1441/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1441/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1441/index.md",
"title": "MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Order Payment Completion via Payment Reuse",
"description": "The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-received redirect handler in all versions up to, and including, 7.3.5, due to the save_payment_token() function trusting the 'orderId' and MONEI payment 'id' query parameters without checking that the payment was created for that order or that the URL carries the order key. This makes it possible for unauthenticated attackers to reuse one successful MONEI payment to mark other orders with the same total as paid, and to have them processed or completed without paying for them.",
"plugin": {
"slug": "monei",
"name": "MONEI Payments for WooCommerce",
"full_name": "MONEI Payments for WooCommerce",
"wordpress_org": "https://wordpress.org/plugins/monei/",
"advisories_url": "https://wpsec.com/vuln/plugin/monei/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/monei"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.3.6",
"to_inclusive": false
}
],
"text": [
"all versions before 7.3.6"
]
},
"introduced_in": null,
"fixed_in": "7.3.6",
"remediation": "Update to 7.3.6 or later.",
"fix_released": "2026-10-21T10:29:32+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:55.779719+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1441/",
"https://plugins.svn.wordpress.org/monei/tags/7.3.6/",
"https://wordpress.org/plugins/monei/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/monei",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1440",
"url": "https://wpsec.com/vuln/WPSEC-2026-1440/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1440/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1440/index.md",
"title": "MONEI Payments for WooCommerce <= 7.3.5 - Authenticated (Subscriber+) Missing Authorization to Payment Token Attachment via Payment Method Redirect",
"description": "The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Missing Authorization via the add-payment-method and order-received redirect handlers in all versions up to, and including, 7.3.5, due to a missing check that the MONEI payment named in the 'id' query parameter was started by the current user or belongs to the order. This makes it possible for authenticated attackers, with Subscriber-level access and above, who know another customer's MONEI payment ID to save that payment's card token to their own account, where it could be used for purchases.",
"plugin": {
"slug": "monei",
"name": "MONEI Payments for WooCommerce",
"full_name": "MONEI Payments for WooCommerce",
"wordpress_org": "https://wordpress.org/plugins/monei/",
"advisories_url": "https://wpsec.com/vuln/plugin/monei/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/monei"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.2,
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.3.6",
"to_inclusive": false
}
],
"text": [
"all versions before 7.3.6"
]
},
"introduced_in": null,
"fixed_in": "7.3.6",
"remediation": "Update to 7.3.6 or later.",
"fix_released": "2026-10-21T10:29:32+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:55.779719+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1440/",
"https://plugins.svn.wordpress.org/monei/tags/7.3.6/",
"https://wordpress.org/plugins/monei/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/monei",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1439",
"url": "https://wpsec.com/vuln/WPSEC-2026-1439/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1439/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1439/index.md",
"title": "MONEI Payments for WooCommerce <= 7.3.5 - Unauthenticated Insecure Direct Object Reference to Subscription Payment Data Update",
"description": "The MONEI Payments for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the subscription order-received and payment-method-change redirect handlers in all versions up to, and including, 7.3.5, due to the subscriptions_save_sequence_id() and subscriptions_save_sequence_id_on_payment_method_change() functions using an order ID from the request without checking the order key or the subscription owner, and without checking that the fetched MONEI payment belongs to that order. This makes it possible for unauthenticated attackers to overwrite the stored MONEI payment data (sequence ID and card details used for renewals) of other customers' subscriptions, when WooCommerce Subscriptions or YITH WooCommerce Subscription is active.",
"plugin": {
"slug": "monei",
"name": "MONEI Payments for WooCommerce",
"full_name": "MONEI Payments for WooCommerce",
"wordpress_org": "https://wordpress.org/plugins/monei/",
"advisories_url": "https://wpsec.com/vuln/plugin/monei/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/monei"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.3.6",
"to_inclusive": false
}
],
"text": [
"all versions before 7.3.6"
]
},
"introduced_in": null,
"fixed_in": "7.3.6",
"remediation": "Update to 7.3.6 or later.",
"fix_released": "2026-10-21T10:29:32+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:55.779719+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1439/",
"https://plugins.svn.wordpress.org/monei/tags/7.3.6/",
"https://wordpress.org/plugins/monei/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/monei",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1438",
"url": "https://wpsec.com/vuln/WPSEC-2026-1438/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1438/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1438/index.md",
"title": "JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Preset Field Values",
"description": "The JetFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field preset values in all versions up to, and including, 3.6.7, due to field default values filled from a preset source (such as stored form records, post or user meta, or URL query variables) being treated as calculated formulas when they contain macro syntax and evaluated as JavaScript by the frontend formula engine. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in another user's browser when that user views a page containing the affected form.",
"plugin": {
"slug": "jetformbuilder",
"name": "JetFormBuilder — Dynamic Blocks Form Builder",
"full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
"wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
"advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.2,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.6.7.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.6.7.1"
]
},
"introduced_in": null,
"fixed_in": "3.6.7.1",
"remediation": "Update to 3.6.7.1 or later.",
"fix_released": "2026-10-21T10:13:03+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:45.480306+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1438/",
"https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.7.1/",
"https://wordpress.org/plugins/jetformbuilder/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1437",
"url": "https://wpsec.com/vuln/WPSEC-2026-1437/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1437/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1437/index.md",
"title": "Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ocs_trigger Shortcode",
"description": "The Off-Canvas Sidebars & Menus (Slidebars) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocs_trigger' shortcode in all versions up to, and including, 0.5.9. This is due to insufficient validation of the shortcode's 'element' and 'attr' attributes. Any element name made of word characters that is not on a short blocklist is accepted (for example iframe), and attribute values are escaped and screened for a few characters but never checked for script URL schemes such as javascript:. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "off-canvas-sidebars",
"name": "Off-Canvas Sidebars & Menus (Slidebars)",
"full_name": "Off-Canvas Sidebars & Menus (Slidebars)",
"wordpress_org": "https://wordpress.org/plugins/off-canvas-sidebars/",
"advisories_url": "https://wpsec.com/vuln/plugin/off-canvas-sidebars/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/off-canvas-sidebars"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "0.5.9.1",
"to_inclusive": false
}
],
"text": [
"all versions before 0.5.9.1"
]
},
"introduced_in": null,
"fixed_in": "0.5.9.1",
"remediation": "Update to 0.5.9.1 or later.",
"fix_released": "2026-10-21T10:12:53+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:50.127129+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1437/",
"https://plugins.svn.wordpress.org/off-canvas-sidebars/tags/0.5.9.1/",
"https://wordpress.org/plugins/off-canvas-sidebars/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/off-canvas-sidebars",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1436",
"url": "https://wpsec.com/vuln/WPSEC-2026-1436/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1436/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1436/index.md",
"title": "Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor HTML Widget Import",
"description": "The Responsive Starter Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-ready-sites-elementor_page_import_process' AJAX action in versions 2.7.3 up to, and including, 3.5.4. This is due to the function saving Elementor data fetched from a URL the user supplies, including HTML widget markup, without checking the unfiltered_html capability or sanitizing the content. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.",
"plugin": {
"slug": "responsive-add-ons",
"name": "Responsive Plus",
"full_name": "Responsive Starter Templates – Elementor Templates & Starter Sites",
"wordpress_org": "https://wordpress.org/plugins/responsive-add-ons/",
"advisories_url": "https://wpsec.com/vuln/plugin/responsive-add-ons/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/responsive-add-ons"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "2.7.3",
"from_inclusive": true,
"to": "3.5.5",
"to_inclusive": false
}
],
"text": [
"from 2.7.3 before 3.5.5"
]
},
"introduced_in": "2.7.3",
"fixed_in": "3.5.5",
"remediation": "Update to 3.5.5 or later.",
"fix_released": "2026-10-21T10:04:08+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:47.860234+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1436/",
"https://plugins.svn.wordpress.org/responsive-add-ons/tags/3.5.5/",
"https://wordpress.org/plugins/responsive-add-ons/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/responsive-add-ons",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1435",
"url": "https://wpsec.com/vuln/WPSEC-2026-1435/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1435/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1435/index.md",
"title": "Responsive Plus <= 3.5.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Elementor Page Content Overwrite via Template Import",
"description": "The Responsive Starter Templates plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'responsive-ready-sites-elementor_page_import_process' AJAX action in versions 2.7.3 up to, and including, 3.5.4. This is due to the elementor_page_import_process() function checking only the edit_posts capability and not whether the user can edit the post given in the 'id' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace the Elementor content of posts and pages they do not own, including other users' published pages, with template data loaded from a URL they supply.",
"plugin": {
"slug": "responsive-add-ons",
"name": "Responsive Plus",
"full_name": "Responsive Starter Templates – Elementor Templates & Starter Sites",
"wordpress_org": "https://wordpress.org/plugins/responsive-add-ons/",
"advisories_url": "https://wpsec.com/vuln/plugin/responsive-add-ons/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/responsive-add-ons"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "2.7.3",
"from_inclusive": true,
"to": "3.5.5",
"to_inclusive": false
}
],
"text": [
"from 2.7.3 before 3.5.5"
]
},
"introduced_in": "2.7.3",
"fixed_in": "3.5.5",
"remediation": "Update to 3.5.5 or later.",
"fix_released": "2026-10-21T10:04:08+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T12:22:47.860234+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1435/",
"https://plugins.svn.wordpress.org/responsive-add-ons/tags/3.5.5/",
"https://wordpress.org/plugins/responsive-add-ons/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/responsive-add-ons",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1434",
"url": "https://wpsec.com/vuln/WPSEC-2026-1434/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1434/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1434/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Cross-Site Request Forgery to Booking Modification and Custom Message Sending",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.17 due to missing nonce validation when the booking edit view applies submitted changes and in the sendcustomsms and sendcustomemail tasks. This makes it possible for unauthenticated attackers to modify booking details such as amounts paid, refunds, payable amounts, cancellation fees, discounts, taxes, payment method, language, room units, customer email, phone and notes, to remove stored card details, or to send arbitrary SMS and email messages, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "CSRF",
"cwe": [
"CWE-352"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.18",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.18"
]
},
"introduced_in": null,
"fixed_in": "1.8.18",
"remediation": "Update to 1.8.18 or later.",
"fix_released": "2026-10-21T09:48:54+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T13:33:54.601155+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1434/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.18/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1433",
"url": "https://wpsec.com/vuln/WPSEC-2026-1433/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1433/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1433/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Sensitive Information Exposure via U-tec Webhook Debug Log",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the U-tec door access webhook endpoint in versions 1.8.7 up to, and including, 1.8.17, due to the U-tec webhook handler writing the raw request body, request parameters and server variables to a webhook_debug.txt file inside the plugin directory, where the web server can serve it. The public apps.webhook endpoint also accepted any door access profile ID for the U-tec provider. This makes it possible for unauthenticated attackers to read the logged webhook data, including requests that U-tec sent to the site, and server environment details from that file, provided at least one door access control profile is configured.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-532"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": "1.8.7",
"from_inclusive": true,
"to": "1.8.18",
"to_inclusive": false
}
],
"text": [
"from 1.8.7 before 1.8.18"
]
},
"introduced_in": "1.8.7",
"fixed_in": "1.8.18",
"remediation": "Update to 1.8.18 or later.",
"fix_released": "2026-10-21T09:48:54+00:00",
"published": "2026-10-22T10:48:20+00:00",
"updated": "2026-10-21T13:33:54.601155+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1433/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.18/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1432",
"url": "https://wpsec.com/vuln/WPSEC-2026-1432/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1432/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1432/index.md",
"title": "Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via OTP Brute Force",
"description": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'verify_otp' AJAX action in all versions up to, and including, 2.8.2, due to the absence of any limit on incorrect signup OTP guesses per email address. The verification code is 4 digits by default, and the nonce the action requires is printed on every front-end page. This makes it possible for unauthenticated attackers to brute force the code sent to an email address they do not control and register an account for that address that is marked as verified.",
"plugin": {
"slug": "customer-email-verification-for-woocommerce",
"name": "Customer Email Verification for WooCommerce",
"full_name": "Customer Email Verification for WooCommerce",
"wordpress_org": "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/",
"advisories_url": "https://wpsec.com/vuln/plugin/customer-email-verification-for-woocommerce/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce"
},
"type": "BYPASS",
"cwe": [
"CWE-307"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "2.3",
"from_inclusive": true,
"to": "2.8.3",
"to_inclusive": false
}
],
"text": [
"from 2.3 before 2.8.3"
]
},
"introduced_in": "2.3",
"fixed_in": "2.8.3",
"remediation": "Update to 2.8.3 or later.",
"fix_released": "2026-10-21T09:42:19+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T12:22:52.449712+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1432/",
"https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.3/",
"https://wordpress.org/plugins/customer-email-verification-for-woocommerce/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1431",
"url": "https://wpsec.com/vuln/WPSEC-2026-1431/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1431/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1431/index.md",
"title": "Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Email Verification Bypass via Predictable Verification Link",
"description": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification Bypass via the 'cusomer_email_verify' verification link in all versions up to, and including, 2.8.2, due to the link's secret code being generated from predictable values: an MD5 hash of the recipient email address and the current timestamp for signup verification, or of the user ID and the current timestamp for account verification. Logged-out visitors can trigger the code for any address through the publicly reachable 'resend_otp' and 'check_email_exists' AJAX actions, which use a nonce printed on every front-end page. This makes it possible for unauthenticated attackers to forge a valid verification link for an email address they do not control. They can mark existing accounts as verified, or create a new customer account for that address and be logged into it, without proving they own the email.",
"plugin": {
"slug": "customer-email-verification-for-woocommerce",
"name": "Customer Email Verification for WooCommerce",
"full_name": "Customer Email Verification for WooCommerce",
"wordpress_org": "https://wordpress.org/plugins/customer-email-verification-for-woocommerce/",
"advisories_url": "https://wpsec.com/vuln/plugin/customer-email-verification-for-woocommerce/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce"
},
"type": "BYPASS",
"cwe": [
"CWE-330"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.3",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.3"
]
},
"introduced_in": null,
"fixed_in": "2.8.3",
"remediation": "Update to 2.8.3 or later.",
"fix_released": "2026-10-21T09:42:19+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T12:22:52.449712+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1431/",
"https://plugins.svn.wordpress.org/customer-email-verification-for-woocommerce/tags/2.8.3/",
"https://wordpress.org/plugins/customer-email-verification-for-woocommerce/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/customer-email-verification-for-woocommerce",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1430",
"url": "https://wpsec.com/vuln/WPSEC-2026-1430/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1430/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1430/index.md",
"title": "SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via Quick View 'post_id' Parameter",
"description": "The SureDash plugin for WordPress is vulnerable to Sensitive Information Exposure via the quick view 'post_id' parameter in all versions up to, and including, 1.12.2, due to the quick view template rendering the post named by 'post_id' without checking its status, read permission or password. The single-content shortcode's post_id attribute had the same missing check. This makes it possible for unauthenticated attackers to view the content of draft, private and password-protected posts of any post type.",
"plugin": {
"slug": "suredash",
"name": "SureDash",
"full_name": "SureDash – Community, Courses & Member Dashboard",
"wordpress_org": "https://wordpress.org/plugins/suredash/",
"advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.12.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.12.3"
]
},
"introduced_in": null,
"fixed_in": "1.12.3",
"remediation": "Update to 1.12.3 or later.",
"fix_released": "2026-10-21T09:04:10+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T13:33:50.331790+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1430/",
"https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
"https://wordpress.org/plugins/suredash/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1429",
"url": "https://wpsec.com/vuln/WPSEC-2026-1429/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1429/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1429/index.md",
"title": "SureDash <= 1.12.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Unapproved Comments in Comment Lists",
"description": "The SureDash plugin for WordPress is vulnerable to Sensitive Information Exposure via the community comment lists in all versions up to, and including, 1.12.2, due to the comment and child-comment queries returning comments of every status, without limiting unapproved comments to moderators and the comment's own author. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view comments that are still waiting for moderation.",
"plugin": {
"slug": "suredash",
"name": "SureDash",
"full_name": "SureDash – Community, Courses & Member Dashboard",
"wordpress_org": "https://wordpress.org/plugins/suredash/",
"advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-284"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.12.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.12.3"
]
},
"introduced_in": null,
"fixed_in": "1.12.3",
"remediation": "Update to 1.12.3 or later.",
"fix_released": "2026-10-21T09:04:10+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T13:33:50.331790+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1429/",
"https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
"https://wordpress.org/plugins/suredash/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1428",
"url": "https://wpsec.com/vuln/WPSEC-2026-1428/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1428/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1428/index.md",
"title": "SureDash <= 1.12.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Community Posts, Comments, and Profile Bio",
"description": "The SureDash plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via community post titles and content, comments, comment and post edits, and the profile bio in all versions up to, and including, 1.12.2, due to the software allowing users to submit content that is passed to do_shortcode() or stored and later rendered through do_shortcode() without neutralising shortcode brackets. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.",
"plugin": {
"slug": "suredash",
"name": "SureDash",
"full_name": "SureDash – Community, Courses & Member Dashboard",
"wordpress_org": "https://wordpress.org/plugins/suredash/",
"advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
},
"type": "RCE",
"cwe": [
"CWE-94"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.12.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.12.3"
]
},
"introduced_in": null,
"fixed_in": "1.12.3",
"remediation": "Update to 1.12.3 or later.",
"fix_released": "2026-10-21T09:04:10+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T13:33:50.331790+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1428/",
"https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
"https://wordpress.org/plugins/suredash/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1427",
"url": "https://wpsec.com/vuln/WPSEC-2026-1427/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1427/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1427/index.md",
"title": "SureDash <= 1.12.2 - Unauthenticated Sensitive Information Exposure via REST API Community Posts and Comments",
"description": "The SureDash plugin for WordPress is vulnerable to Sensitive Information Exposure via the core REST API community-post and comments routes in all versions up to, and including, 1.12.2, due to those routes not applying the plugin's private-community and protected-post access rules. This makes it possible for unauthenticated attackers to read restricted community posts and comments on protected posts.",
"plugin": {
"slug": "suredash",
"name": "SureDash",
"full_name": "SureDash – Community, Courses & Member Dashboard",
"wordpress_org": "https://wordpress.org/plugins/suredash/",
"advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-284"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.12.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.12.3"
]
},
"introduced_in": null,
"fixed_in": "1.12.3",
"remediation": "Update to 1.12.3 or later.",
"fix_released": "2026-10-21T09:04:10+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T13:33:50.331790+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1427/",
"https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
"https://wordpress.org/plugins/suredash/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1426",
"url": "https://wpsec.com/vuln/WPSEC-2026-1426/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1426/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1426/index.md",
"title": "SureDash <= 1.12.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via Image Source in Community Posts",
"description": "The SureDash plugin for WordPress is vulnerable to Blind Server-Side Request Forgery via the image source URL in community post content in all versions up to, and including, 1.12.2, due to the image preview processing calling getimagesize() on the src URL of images that have no height attribute and are not local attachments. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and probe internal services.",
"plugin": {
"slug": "suredash",
"name": "SureDash",
"full_name": "SureDash – Community, Courses & Member Dashboard",
"wordpress_org": "https://wordpress.org/plugins/suredash/",
"advisories_url": "https://wpsec.com/vuln/plugin/suredash/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/suredash"
},
"type": "SSRF",
"cwe": [
"CWE-918"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.12.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.12.3"
]
},
"introduced_in": null,
"fixed_in": "1.12.3",
"remediation": "Update to 1.12.3 or later.",
"fix_released": "2026-10-21T09:04:10+00:00",
"published": "2026-10-22T09:43:07+00:00",
"updated": "2026-10-21T13:33:50.331790+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1426/",
"https://plugins.svn.wordpress.org/suredash/tags/1.12.3/",
"https://wordpress.org/plugins/suredash/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/suredash",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1425",
"url": "https://wpsec.com/vuln/WPSEC-2026-1425/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1425/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1425/index.md",
"title": "Advanced Block Animation <= 4.4.2 - Unauthenticated DOM-Based Cross-Site Scripting via Inline HTML Preview Script",
"description": "The Advanced Addons plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the inline HTML preview script in all versions up to, and including, 4.4.2. The cause is that the script, printed in the footer of every front-end page for logged-in users when Elementor is active, takes the text of any heading or paragraph element on the page, treats escaped tag text as markup, and assigns it to innerHTML without sanitization. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a logged-in user's browser, such as an administrator's. The attacker places tag-like text in content that the page shows escaped inside a heading or paragraph, such as a search query reflected in the page title, a comment, or post content written by a contributor, and gets the user to view the page or follow a link.",
"plugin": {
"slug": "advanced-animation",
"name": "Advanced Block Animation",
"full_name": "AI website builder for the block editor and Elementor – Advanced Addons",
"wordpress_org": "https://wordpress.org/plugins/advanced-animation/",
"advisories_url": "https://wpsec.com/vuln/plugin/advanced-animation/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-animation"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.5.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.5.0"
]
},
"introduced_in": null,
"fixed_in": "4.5.0",
"remediation": "Update to 4.5.0 or later.",
"fix_released": "2026-10-21T08:15:24+00:00",
"published": "2026-10-22T08:42:12+00:00",
"updated": "2026-10-21T10:36:02.372320+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1425/",
"https://plugins.svn.wordpress.org/advanced-animation/tags/4.5.0/",
"https://wordpress.org/plugins/advanced-animation/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-animation",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1424",
"url": "https://wpsec.com/vuln/WPSEC-2026-1424/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1424/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1424/index.md",
"title": "GDPR Compliance & Cookie Consent <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Data Access Form Class Settings",
"description": "The GDPR Compliance & Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Input field classes' and 'Submit button classes' settings of the data access form in all versions up to, and including, 1.6.2, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts that execute whenever a user visits a page that shows the data access form (the [stm-gpdr-data-access] shortcode or the GDPR Compliance widget). This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "gdpr-compliance-cookie-consent",
"name": "GDPR Compliance & Cookie Consent",
"full_name": "GDPR Compliance & Cookie Consent",
"wordpress_org": "https://wordpress.org/plugins/gdpr-compliance-cookie-consent/",
"advisories_url": "https://wpsec.com/vuln/plugin/gdpr-compliance-cookie-consent/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/gdpr-compliance-cookie-consent"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.6.3",
"to_inclusive": false
}
],
"text": [
"all versions before 1.6.3"
]
},
"introduced_in": null,
"fixed_in": "1.6.3",
"remediation": "Update to 1.6.3 or later.",
"fix_released": "2026-10-21T06:26:46+00:00",
"published": "2026-10-22T06:45:07+00:00",
"updated": "2026-10-21T12:33:44.641541+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1424/",
"https://plugins.svn.wordpress.org/gdpr-compliance-cookie-consent/tags/1.6.3/",
"https://wordpress.org/plugins/gdpr-compliance-cookie-consent/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/gdpr-compliance-cookie-consent",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1423",
"url": "https://wpsec.com/vuln/WPSEC-2026-1423/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1423/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1423/index.md",
"title": "Mortgage Calculator <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mortgage_calculator' Shortcode 'title' Attribute",
"description": "The Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the 'mortgage_calculator' shortcode in all versions up to, and including, 1.3.0, due to insufficient input sanitization and output escaping on the user-supplied attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "mortgage-calculator",
"name": "Mortgage Calculator",
"full_name": "Mortgage Calculator",
"wordpress_org": "https://wordpress.org/plugins/mortgage-calculator/",
"advisories_url": "https://wpsec.com/vuln/plugin/mortgage-calculator/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/mortgage-calculator"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "1.2.0",
"from_inclusive": true,
"to": "1.3.1",
"to_inclusive": false
}
],
"text": [
"from 1.2.0 before 1.3.1"
]
},
"introduced_in": "1.2.0",
"fixed_in": "1.3.1",
"remediation": "Update to 1.3.1 or later.",
"fix_released": "2026-10-21T06:26:38+00:00",
"published": "2026-10-22T06:45:07+00:00",
"updated": "2026-10-21T10:35:21.680667+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1423/",
"https://plugins.svn.wordpress.org/mortgage-calculator/tags/1.3.1/",
"https://wordpress.org/plugins/mortgage-calculator/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/mortgage-calculator",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1422",
"url": "https://wpsec.com/vuln/WPSEC-2026-1422/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1422/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1422/index.md",
"title": "Rio EMI Calculator <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Currency Display Setting",
"description": "The EMI Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'curr_display' value of the plugin's 'rio_settings' option in all versions up to, and including, 1.4.1, due to insufficient input sanitization when the setting is saved and missing output escaping when the value is rendered by the [rio-emi-calculator] shortcode. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the calculator. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "rio-emi-calculator",
"name": "Rio EMI Calculator",
"full_name": "EMI Calculator",
"wordpress_org": "https://wordpress.org/plugins/rio-emi-calculator/",
"advisories_url": "https://wpsec.com/vuln/plugin/rio-emi-calculator/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/rio-emi-calculator"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.4.2",
"to_inclusive": false
}
],
"text": [
"all versions before 1.4.2"
]
},
"introduced_in": null,
"fixed_in": "1.4.2",
"remediation": "Update to 1.4.2 or later.",
"fix_released": "2026-10-21T06:26:37+00:00",
"published": "2026-10-22T06:45:07+00:00",
"updated": "2026-10-21T12:34:10.754487+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1422/",
"https://plugins.svn.wordpress.org/rio-emi-calculator/tags/1.4.2/",
"https://wordpress.org/plugins/rio-emi-calculator/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/rio-emi-calculator",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1421",
"url": "https://wpsec.com/vuln/WPSEC-2026-1421/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1421/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1421/index.md",
"title": "BMI Adult & Kid Calculator <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id_calc' Shortcode Attribute",
"description": "The BMI Adult & Kid Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_calc' attribute of the BMIAKC_kid_calc shortcode in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization, as the attribute is output unquoted into inline JavaScript variable and function names with only esc_attr(), which does not prevent JavaScript injection. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "bmi-adultkid-calculator",
"name": "BMI Adult & Kid Calculator",
"full_name": "BMI Adult & Kid Calculator",
"wordpress_org": "https://wordpress.org/plugins/bmi-adultkid-calculator/",
"advisories_url": "https://wpsec.com/vuln/plugin/bmi-adultkid-calculator/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/bmi-adultkid-calculator"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.2.4",
"to_inclusive": false
}
],
"text": [
"all versions before 1.2.4"
]
},
"introduced_in": null,
"fixed_in": "1.2.4",
"remediation": "Update to 1.2.4 or later.",
"fix_released": "2026-10-21T06:26:16+00:00",
"published": "2026-10-22T06:45:07+00:00",
"updated": "2026-10-21T12:34:04.235977+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1421/",
"https://plugins.svn.wordpress.org/bmi-adultkid-calculator/tags/1.2.4/",
"https://wordpress.org/plugins/bmi-adultkid-calculator/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/bmi-adultkid-calculator",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1420",
"url": "https://wpsec.com/vuln/WPSEC-2026-1420/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1420/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1420/index.md",
"title": "3D viewer – Embed 3D Models <= 1.9.4 - Authenticated (Contributor+) Sensitive Information Exposure via [3d_viewer] Shortcode",
"description": "The 3D Viewer plugin for WordPress is vulnerable to Sensitive Information Exposure via the [3d_viewer] shortcode in all versions up to, and including, 1.9.4. This is due to the shortcode rendering any 3D viewer or product post by its user-supplied 'id' attribute without checking the post's status, password protection, or the current user's permission to read it. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed draft, private, trashed, or password-protected viewers in a post or preview and view their model files, poster URLs and settings.",
"plugin": {
"slug": "3d-viewer",
"name": "3D viewer – Embed 3D Models",
"full_name": "3D Viewer – Turn Product Pages into Interactive 3D Experiences",
"wordpress_org": "https://wordpress.org/plugins/3d-viewer/",
"advisories_url": "https://wpsec.com/vuln/plugin/3d-viewer/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/3d-viewer"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.0.0",
"to_inclusive": false
}
],
"text": [
"all versions before 2.0.0"
]
},
"introduced_in": null,
"fixed_in": "2.0.0",
"remediation": "Update to 2.0.0 or later.",
"fix_released": "2026-10-21T04:07:43+00:00",
"published": "2026-10-22T04:41:29+00:00",
"updated": "2026-10-21T12:33:38.765998+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1420/",
"https://plugins.svn.wordpress.org/3d-viewer/tags/2.0.0/",
"https://wordpress.org/plugins/3d-viewer/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/3d-viewer",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1419",
"url": "https://wpsec.com/vuln/WPSEC-2026-1419/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1419/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1419/index.md",
"title": "Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie",
"description": "The Jock On Air Now (JOAN) plugin for WordPress is vulnerable to Limited Path Traversal via the 'joan_visitor_locale' cookie in all versions up to, and including, 6.1.3. This is due to the cookie value being passed only through sanitize_text_field(), without being restricted to a well-formed locale code or to a locale the plugin ships. The value is then returned as the site locale on front-end requests and used to build the path of the translation file to load. This makes it possible for unauthenticated attackers to use directory traversal sequences to make WordPress load translation files (.mo / .l10n.php) from other places on the server.",
"plugin": {
"slug": "joan",
"name": "Jock On Air Now (JOAN)",
"full_name": "Jock On Air Now (JOAN)",
"wordpress_org": "https://wordpress.org/plugins/joan/",
"advisories_url": "https://wpsec.com/vuln/plugin/joan/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/joan"
},
"type": "TRAVERSAL",
"cwe": [
"CWE-22"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "6.0.9",
"from_inclusive": true,
"to": "6.1.4",
"to_inclusive": false
}
],
"text": [
"from 6.0.9 before 6.1.4"
]
},
"introduced_in": "6.0.9",
"fixed_in": "6.1.4",
"remediation": "Update to 6.1.4 or later.",
"fix_released": "2026-10-20T21:32:42+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T10:35:38.306698+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1419/",
"https://plugins.svn.wordpress.org/joan/tags/6.1.4/",
"https://wordpress.org/plugins/joan/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/joan",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1418",
"url": "https://wpsec.com/vuln/WPSEC-2026-1418/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1418/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1418/index.md",
"title": "Related Posts for WordPress <= 3.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via Related Posts Link Screen and Meta Box",
"description": "The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the Related Posts link screen and meta box in all versions up to, and including, 3.0.0, due to missing checks on whether the current user can read a post. The All Posts view of the link screen lists other users' private posts, with titles and dates. The link handlers (rp4wp_create_link and rp4wp_bulk) accept any post ID, and the Related Posts meta box shows the title of every linked post. This makes it possible for authenticated attackers with Contributor-level access and above to learn the titles of draft, pending, scheduled, private or trashed posts of other users by linking them to a post of their own.",
"plugin": {
"slug": "related-posts-for-wp",
"name": "Related Posts for WordPress",
"full_name": "Related Posts for WordPress",
"wordpress_org": "https://wordpress.org/plugins/related-posts-for-wp/",
"advisories_url": "https://wpsec.com/vuln/plugin/related-posts-for-wp/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/related-posts-for-wp"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.0.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.0.1"
]
},
"introduced_in": null,
"fixed_in": "3.0.1",
"remediation": "Update to 3.0.1 or later.",
"fix_released": "2026-10-20T21:18:18+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T10:35:45.171694+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1418/",
"https://plugins.svn.wordpress.org/related-posts-for-wp/tags/3.0.1/",
"https://wordpress.org/plugins/related-posts-for-wp/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/related-posts-for-wp",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1417",
"url": "https://wpsec.com/vuln/WPSEC-2026-1417/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1417/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1417/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom API Credential Modification via Migration Action",
"description": "The eRoom plugin for WordPress is vulnerable to unauthorized modification of data via the stm_zoom_migration_action AJAX action in all versions up to, and including, 1.7.1, due to a missing capability check in the stm_zoom_migration() function, whose nonce is printed on every admin page to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the plugin's Zoom Server-to-Server OAuth credentials (account ID, client ID and client secret) to those of a Zoom account they control, on sites where these credentials have not yet been configured. Meetings the site creates afterwards then go to the attacker's Zoom account.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.2"
]
},
"introduced_in": null,
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1417/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1416",
"url": "https://wpsec.com/vuln/WPSEC-2026-1416/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1416/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1416/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Deletion",
"description": "The eRoom plugin for WordPress is vulnerable to unauthorized modification and loss of data via the stm_zoom_delete_from_api AJAX action in all versions up to, and including, 1.7.1, due to a missing capability check. The handler checks only a nonce, and that nonce is printed on every admin page to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary meetings or webinars from the connected Zoom account and remove the Zoom meeting data stored on any post.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.2"
]
},
"introduced_in": null,
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1416/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1415",
"url": "https://wpsec.com/vuln/WPSEC-2026-1415/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1415/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1415/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Zoom Meeting Synchronization",
"description": "The eRoom plugin for WordPress is vulnerable to unauthorized modification of data via the stm_zoom_sync_meetings_webinars AJAX action in versions 1.3.8 up to, and including, 1.7.1, due to a missing capability check. The 1.3.8 fix for the earlier unauthorized setting update in this handler added only a nonce check. The handler checks only a nonce, and that nonce is printed on every admin page to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a synchronization that creates or updates meetings in the connected Zoom account and creates or updates meeting posts on the site.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "1.3.8",
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"from 1.3.8 before 1.7.2"
]
},
"introduced_in": "1.3.8",
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1415/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1414",
"url": "https://wpsec.com/vuln/WPSEC-2026-1414/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1414/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1414/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Settings Map AJAX Action",
"description": "The eRoom plugin for WordPress is vulnerable to Sensitive Information Exposure via the stm_wpcfto_get_settings AJAX action in versions 1.4.7 to 1.7.1, due to an incomplete fix for CVE-2022-43472. Since 1.4.7 the bundled settings framework's stm_wpcfto_get_settings_callback() function checks only a nonce and no capability, and that nonce is printed on every admin page to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the plugin settings, including the Zoom API and SDK secrets, as well as meta box data of posts they cannot edit.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "1.4.7",
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"from 1.4.7 before 1.7.2"
]
},
"introduced_in": "1.4.7",
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1414/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1413",
"url": "https://wpsec.com/vuln/WPSEC-2026-1413/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1413/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1413/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Overwrite via Font Regeneration",
"description": "The eRoom plugin for WordPress is vulnerable to unauthorized modification of data via the wpcfto_regenerate_fonts AJAX action in all versions up to, and including, 1.7.1, due to an incorrect capability check in the bundled settings framework's stm_regenerate_fonts() function. Its two conditions are joined with && instead of ||, so the check passes for every logged-in user, and the function's nonce is printed on every page to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin settings with the contents of any other option, or with an empty value, which wipes the Zoom configuration.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-863"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.2"
]
},
"introduced_in": null,
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1413/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1412",
"url": "https://wpsec.com/vuln/WPSEC-2026-1412/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1412/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1412/index.md",
"title": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Unauthenticated Zoom Meeting Host Role Escalation via Signature Generation",
"description": "The eRoom plugin for WordPress is vulnerable to Privilege Escalation via the stm_zoom_meeting_sign AJAX action in all versions up to, and including, 1.7.1, due to the generate_signature() function taking the Zoom participant role from the request body without checking it. This makes it possible for unauthenticated attackers to obtain a Zoom Meeting SDK signature with the host role (role=1) for any published meeting or webinar, which, depending on the Zoom account's settings, can let them join that meeting with host privileges.",
"plugin": {
"slug": "eroom-zoom-meetings-webinar",
"name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"full_name": "eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams",
"wordpress_org": "https://wordpress.org/plugins/eroom-zoom-meetings-webinar/",
"advisories_url": "https://wpsec.com/vuln/plugin/eroom-zoom-meetings-webinar/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar"
},
"type": "PRIV",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.2",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.2"
]
},
"introduced_in": null,
"fixed_in": "1.7.2",
"remediation": "Update to 1.7.2 or later.",
"fix_released": "2026-10-20T21:17:20+00:00",
"published": "2026-10-21T21:41:50+00:00",
"updated": "2026-10-21T12:33:51.241235+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1412/",
"https://plugins.svn.wordpress.org/eroom-zoom-meetings-webinar/tags/1.7.2/",
"https://wordpress.org/plugins/eroom-zoom-meetings-webinar/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/eroom-zoom-meetings-webinar",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1411",
"url": "https://wpsec.com/vuln/WPSEC-2026-1411/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1411/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1411/index.md",
"title": "W3 Total Cache <= 2.10.7 - Unauthenticated Minify Cache Poisoning via 'b' Parameter and Query String",
"description": "The W3 Total Cache plugin for WordPress is vulnerable to minify cache poisoning in all versions up to, and including, 2.10.7. In auto minify mode, public minified file requests accepted a query string on the file name, kept the request's 'b' (base) parameter, and derived the cache ID from the raw requested name. The base parameter could reroot the stored document-root-relative file list, and nothing stopped sources from inside the minify cache directory being used. This makes it possible for unauthenticated attackers to make the minifier build cached CSS/JS artifacts from files other than the intended ones, poisoning or misdirecting the minified assets served to site visitors.",
"plugin": {
"slug": "w3-total-cache",
"name": "W3 Total Cache",
"full_name": "W3 Total Cache",
"wordpress_org": "https://wordpress.org/plugins/w3-total-cache/",
"advisories_url": "https://wpsec.com/vuln/plugin/w3-total-cache/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/w3-total-cache"
},
"type": "CONTENT INJECTION",
"cwe": [
"CWE-73"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 2.11.0"
]
},
"introduced_in": null,
"fixed_in": "2.11.0",
"remediation": "Update to 2.11.0 or later.",
"fix_released": "2026-10-20T20:36:47+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T12:33:09.908762+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1411/",
"https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/",
"https://wordpress.org/plugins/w3-total-cache/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/w3-total-cache",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1410",
"url": "https://wpsec.com/vuln/WPSEC-2026-1410/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1410/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1410/index.md",
"title": "W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Cached REST API Responses",
"description": "The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cached REST API responses in all versions up to, and including, 2.10.7. When the REST cache mode was left set to 'cache' without Pro active and Page Cache used Disk: Enhanced, REST JSON responses were stored as '.html' static files with no nosniff header, so the web server served them as text/html. This makes it possible for unauthenticated attackers to get markup contained in REST response content executed as script in the browser of a user who visits the cached REST URL. Exploitation requires this non-default configuration.",
"plugin": {
"slug": "w3-total-cache",
"name": "W3 Total Cache",
"full_name": "W3 Total Cache",
"wordpress_org": "https://wordpress.org/plugins/w3-total-cache/",
"advisories_url": "https://wpsec.com/vuln/plugin/w3-total-cache/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/w3-total-cache"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 2.11.0"
]
},
"introduced_in": null,
"fixed_in": "2.11.0",
"remediation": "Update to 2.11.0 or later.",
"fix_released": "2026-10-20T20:36:47+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T12:33:09.908762+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1410/",
"https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/",
"https://wordpress.org/plugins/w3-total-cache/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/w3-total-cache",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1409",
"url": "https://wpsec.com/vuln/WPSEC-2026-1409/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1409/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1409/index.md",
"title": "W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders",
"description": "The W3 Total Cache plugin for WordPress is vulnerable to content injection in all versions up to, and including, 2.10.7 due to HTML and CSS minifier placeholder tokens being derived from md5 of the request time, which makes them predictable. This makes it possible for unauthenticated attackers to submit content, such as comments, containing a guessed placeholder that is substituted with reserved page blocks (for example scripts or styles) during minification, altering the structure of the generated page. Exploitation requires HTML minification to be enabled and the placeholder to be guessed correctly.",
"plugin": {
"slug": "w3-total-cache",
"name": "W3 Total Cache",
"full_name": "W3 Total Cache",
"wordpress_org": "https://wordpress.org/plugins/w3-total-cache/",
"advisories_url": "https://wpsec.com/vuln/plugin/w3-total-cache/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/w3-total-cache"
},
"type": "CONTENT INJECTION",
"cwe": [
"CWE-330"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 2.11.0"
]
},
"introduced_in": null,
"fixed_in": "2.11.0",
"remediation": "Update to 2.11.0 or later.",
"fix_released": "2026-10-20T20:36:47+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T12:33:09.908762+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1409/",
"https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/",
"https://wordpress.org/plugins/w3-total-cache/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/w3-total-cache",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1408",
"url": "https://wpsec.com/vuln/WPSEC-2026-1408/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1408/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1408/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Cross-Site Request Forgery to Booking Modification, Deletion and Data Export",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.16 due to missing or incorrect nonce validation on several administrative tasks, including updatebusy, updatebusydoinv, removebusy, removeorders, icsexportlaunch, csvexportlaunch, exportcustomerslaunch and condtext_update_tmpl. This makes it possible for unauthenticated attackers to edit or delete bookings, trigger data exports, or rewrite conditional text template files via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "CSRF",
"cwe": [
"CWE-352"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.17",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.17"
]
},
"introduced_in": null,
"fixed_in": "1.8.17",
"remediation": "Update to 1.8.17 or later.",
"fix_released": "2026-10-20T20:04:29+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:35:47.608407+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1408/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.17/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1407",
"url": "https://wpsec.com/vuln/WPSEC-2026-1407/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1407/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1407/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Reflected Cross-Site Scripting via 'vbo_active_tab', 'vbo_lang', 'goto' and 'status' Parameters",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vbo_active_tab', 'vbo_lang', 'goto' and 'status' parameters in all versions up to, and including, 1.8.16, due to insufficient output escaping in the admin booking details, translations, choose-busy and bookings list views. The values are only passed through sanitize_text_field(), which keeps quote characters, and are then printed into inline JavaScript strings and href attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.17",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.17"
]
},
"introduced_in": null,
"fixed_in": "1.8.17",
"remediation": "Update to 1.8.17 or later.",
"fix_released": "2026-10-20T20:04:29+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:35:47.608407+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1407/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.17/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1406",
"url": "https://wpsec.com/vuln/WPSEC-2026-1406/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1406/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1406/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Pre-Check-in Guest Fields",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file-type guest fields submitted through the front-end pre-check-in form in all versions up to, and including, 1.8.16, due to insufficient input sanitization and output escaping. The storeprecheckin task stores the raw guest values, and the admin booking check-in view prints them without escaping into a hidden input's value attribute. This makes it possible for unauthenticated attackers who hold a confirmed booking to inject arbitrary web scripts that execute when an administrator opens the booking check-in page.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.17",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.17"
]
},
"introduced_in": null,
"fixed_in": "1.8.17",
"remediation": "Update to 1.8.17 or later.",
"fix_released": "2026-10-20T20:04:29+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:35:47.608407+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1406/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.17/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1405",
"url": "https://wpsec.com/vuln/WPSEC-2026-1405/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1405/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1405/index.md",
"title": "VikBooking Hotel Booking Engine & PMS <= 1.8.16 - Unauthenticated Stored Cross-Site Scripting via Customer Email",
"description": "The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking form in all versions up to, and including, 1.8.16, due to insufficient output escaping. The email validation accepts a quoted local part that contains double quotes and attribute text, and the stored value is printed without escaping into the value attribute of the cancellation and modification request forms on the front-end booking details page. This makes it possible for unauthenticated attackers who place a booking to inject arbitrary web scripts that execute when a user, such as a site administrator, opens the booking details page of a confirmed reservation.",
"plugin": {
"slug": "vikbooking",
"name": "VikBooking Hotel Booking Engine & PMS",
"full_name": "VikBooking Hotel Booking Engine & PMS",
"wordpress_org": "https://wordpress.org/plugins/vikbooking/",
"advisories_url": "https://wpsec.com/vuln/plugin/vikbooking/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/vikbooking"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.8.17",
"to_inclusive": false
}
],
"text": [
"all versions before 1.8.17"
]
},
"introduced_in": null,
"fixed_in": "1.8.17",
"remediation": "Update to 1.8.17 or later.",
"fix_released": "2026-10-20T20:04:29+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:35:47.608407+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1405/",
"https://plugins.svn.wordpress.org/vikbooking/tags/1.8.17/",
"https://wordpress.org/plugins/vikbooking/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikbooking",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1404",
"url": "https://wpsec.com/vuln/WPSEC-2026-1404/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1404/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1404/index.md",
"title": "Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute",
"description": "The Picture Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the videowhisper_pictures shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping, as the attribute was inserted directly into JavaScript and HTML identifiers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "picture-gallery",
"name": "Picture Gallery – Frontend Image Uploads, AJAX Photo List",
"full_name": "Picture Gallery – Frontend Image Uploads, AJAX Photo List",
"wordpress_org": "https://wordpress.org/plugins/picture-gallery/",
"advisories_url": "https://wpsec.com/vuln/plugin/picture-gallery/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/picture-gallery"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.21",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.21"
]
},
"introduced_in": null,
"fixed_in": "1.7.21",
"remediation": "Update to 1.7.21 or later.",
"fix_released": "2026-10-20T19:55:16+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:36:04.708049+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1404/",
"https://plugins.svn.wordpress.org/picture-gallery/tags/1.7.21/",
"https://wordpress.org/plugins/picture-gallery/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/picture-gallery",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1403",
"url": "https://wpsec.com/vuln/WPSEC-2026-1403/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1403/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1403/index.md",
"title": "Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Path Traversal to Arbitrary File Read via 'importFiles' Parameter",
"description": "The Picture Gallery plugin for WordPress is vulnerable to Path Traversal via the 'importFiles' parameter of the picture import form (videowhisper_picture_import shortcode) in all versions up to, and including, 1.6.2. This is due to submitted file names not being sanitized before they are joined to the import folder path, and the import folder (the shortcode's 'path' attribute) not being limited to the configured import directory. This makes it possible for authenticated attackers, with Contributor-level access and above (the plugin's default sharing roles), to copy arbitrary files from the server into the plugin's public uploads directory as published pictures and then read their contents, which may expose sensitive information.",
"plugin": {
"slug": "picture-gallery",
"name": "Picture Gallery – Frontend Image Uploads, AJAX Photo List",
"full_name": "Picture Gallery – Frontend Image Uploads, AJAX Photo List",
"wordpress_org": "https://wordpress.org/plugins/picture-gallery/",
"advisories_url": "https://wpsec.com/vuln/plugin/picture-gallery/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/picture-gallery"
},
"type": "TRAVERSAL",
"cwe": [
"CWE-22"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.21",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.21"
]
},
"introduced_in": null,
"fixed_in": "1.7.21",
"remediation": "Update to 1.7.21 or later.",
"fix_released": "2026-10-20T19:55:16+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:36:04.708049+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1403/",
"https://plugins.svn.wordpress.org/picture-gallery/tags/1.7.21/",
"https://wordpress.org/plugins/picture-gallery/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/picture-gallery",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1402",
"url": "https://wpsec.com/vuln/WPSEC-2026-1402/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1402/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1402/index.md",
"title": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change",
"description": "The WP User Manager plugin for WordPress is vulnerable to a paid access bypass via the Stripe integration in versions 2.9 up to, and including, 2.9.26. This is due to User::isSubscribed() treating any active Stripe subscription as paid, and User::getAllowedPlanIds() counting the subscription's current price as one of the member's allowed plans, without checking that price against the plan the member registered for. This makes it possible for authenticated attackers with an active subscription and Subscriber-level access or above to switch their subscription to a cheaper price, including one offered on another registration form, through the Stripe customer portal and keep the role and access of the plan they registered for. Exploitation requires plan switching to be enabled in the site's Stripe customer portal configuration.",
"plugin": {
"slug": "wp-user-manager",
"name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
"full_name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
"wordpress_org": "https://wordpress.org/plugins/wp-user-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/wp-user-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-manager"
},
"type": "BYPASS",
"cwe": [
"CWE-840"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.2,
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "2.9",
"from_inclusive": true,
"to": "2.10.0",
"to_inclusive": false
}
],
"text": [
"from 2.9 before 2.10.0"
]
},
"introduced_in": "2.9",
"fixed_in": "2.10.0",
"remediation": "Update to 2.10.0 or later.",
"fix_released": "2026-10-20T19:49:02+00:00",
"published": "2026-10-21T20:43:15+00:00",
"updated": "2026-10-21T10:34:28.908872+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1402/",
"https://plugins.svn.wordpress.org/wp-user-manager/tags/2.10.0/",
"https://wordpress.org/plugins/wp-user-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1401",
"url": "https://wpsec.com/vuln/WPSEC-2026-1401/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1401/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1401/index.md",
"title": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Unauthorized Future Action Scheduling",
"description": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to unauthorized future action scheduling via the publishpress_future_action REST field, the post-expiration REST endpoint, the classic editor metabox and bulk edit in all versions up to, and including, 4.10.7, due to missing per-action capability checks. These handlers only verified that the user had the publishpress_future_expire_post capability and could edit the post. This makes it possible for authenticated attackers with Contributor-level access and above who have been granted that capability to schedule actions they cannot perform directly, such as publishing or making private their own drafts, deleting posts, or sticking and unsticking posts, which later run via cron.",
"plugin": {
"slug": "post-expirator",
"name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
"full_name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
"wordpress_org": "https://wordpress.org/plugins/post-expirator/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-expirator/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-expirator"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.11.0"
]
},
"introduced_in": null,
"fixed_in": "4.11.0",
"remediation": "Update to 4.11.0 or later.",
"fix_released": "2026-10-20T19:23:14+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T10:34:48.243592+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1401/",
"https://plugins.svn.wordpress.org/post-expirator/tags/4.11.0/",
"https://wordpress.org/plugins/post-expirator/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-expirator",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1400",
"url": "https://wpsec.com/vuln/WPSEC-2026-1400/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1400/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1400/index.md",
"title": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Term Creation",
"description": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to unauthorized term creation via the taxonomy terms of a scheduled future action in all versions up to, and including, 4.10.7, due to the normalizeTermsCreatingIfNecessary function calling wp_insert_term without checking the taxonomy's edit_terms capability or verifying that the taxonomy belongs to the post type. This makes it possible for authenticated attackers with Contributor-level access and above who have been granted the publishpress_future_expire_post capability to create arbitrary terms, such as categories, in any registered taxonomy.",
"plugin": {
"slug": "post-expirator",
"name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
"full_name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
"wordpress_org": "https://wordpress.org/plugins/post-expirator/",
"advisories_url": "https://wpsec.com/vuln/plugin/post-expirator/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/post-expirator"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.11.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.11.0"
]
},
"introduced_in": null,
"fixed_in": "4.11.0",
"remediation": "Update to 4.11.0 or later.",
"fix_released": "2026-10-20T19:23:14+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T10:34:48.243592+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1400/",
"https://plugins.svn.wordpress.org/post-expirator/tags/4.11.0/",
"https://wordpress.org/plugins/post-expirator/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-expirator",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1399",
"url": "https://wpsec.com/vuln/WPSEC-2026-1399/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1399/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1399/index.md",
"title": "SureCart <= 4.9.6 - Unauthenticated Authentication Bypass via Passwordless Login Verification Code",
"description": "The SureCart plugin for WordPress is vulnerable to Authentication Bypass via the passwordless login verification code REST endpoints in versions 1.4.0 up to, and including, 4.9.6. This is due to the plugin forwarding all user-supplied query parameters to the upstream verification request that carries the email address of the account being logged into, and logging that account in whenever the upstream service reports a code as verified, without confirming that the verified code belongs to that account's email address. This makes it possible for unauthenticated attackers to complete the login of another user with a code issued to an email address they control, taking over that user's account. In versions before 4.9.6 this includes administrator accounts; 4.9.6 excludes accounts with content-editing or store-management capabilities from code login by default.",
"plugin": {
"slug": "surecart",
"name": "SureCart",
"full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
"wordpress_org": "https://wordpress.org/plugins/surecart/",
"advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-287"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 9.8,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"severity": "Critical"
},
"affected": {
"ranges": [
{
"from": "1.4.0",
"from_inclusive": true,
"to": "4.10.0",
"to_inclusive": false
}
],
"text": [
"from 1.4.0 before 4.10.0"
]
},
"introduced_in": "1.4.0",
"fixed_in": "4.10.0",
"remediation": "Update to 4.10.0 or later.",
"fix_released": "2026-10-20T19:00:25+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T12:33:40.961511+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1399/",
"https://plugins.svn.wordpress.org/surecart/tags/4.10.0/",
"https://wordpress.org/plugins/surecart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1398",
"url": "https://wpsec.com/vuln/WPSEC-2026-1398/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1398/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1398/index.md",
"title": "SureCart <= 4.9.6 - Authenticated (Author+) Stored Cross-Site Scripting via Block Icon Name",
"description": "The SureCart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the icon name block attribute in all versions up to, and including, 4.9.6. This is due to the block editor's icon component building a fetch path from the unvalidated icon name and injecting the fetched document's markup into the page, and the server-side SVG loader likewise concatenating the name into a file path. This makes it possible for authenticated attackers with author-level access and above, who can upload a text file containing markup, to point a block's icon at that file and inject arbitrary web scripts that execute when another user, such as an administrator, opens the post in the block editor.",
"plugin": {
"slug": "surecart",
"name": "SureCart",
"full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
"wordpress_org": "https://wordpress.org/plugins/surecart/",
"advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.10.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.10.0"
]
},
"introduced_in": null,
"fixed_in": "4.10.0",
"remediation": "Update to 4.10.0 or later.",
"fix_released": "2026-10-20T19:00:25+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T12:33:40.961511+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1398/",
"https://plugins.svn.wordpress.org/surecart/tags/4.10.0/",
"https://wordpress.org/plugins/surecart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1397",
"url": "https://wpsec.com/vuln/WPSEC-2026-1397/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1397/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1397/index.md",
"title": "SureCart <= 4.9.6 - Unauthenticated Path Traversal via REST API 'id' Parameter",
"description": "The SureCart plugin for WordPress is vulnerable to Path Traversal via the REST API 'id' parameter in all versions up to, and including, 4.9.6. This is due to upstream API endpoints being built from request 'id' values without rejecting dot segments or query delimiters, and to body or query values named 'id' taking precedence over the route's URL capture. This makes it possible for unauthenticated attackers, using publicly accessible routes such as checkout retrieval and update, to send the plugin's store-authenticated platform requests to other upstream endpoints, for example to mark a checkout as manually paid or read other platform objects.",
"plugin": {
"slug": "surecart",
"name": "SureCart",
"full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
"wordpress_org": "https://wordpress.org/plugins/surecart/",
"advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
},
"type": "TRAVERSAL",
"cwe": [
"CWE-22"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.10.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.10.0"
]
},
"introduced_in": null,
"fixed_in": "4.10.0",
"remediation": "Update to 4.10.0 or later.",
"fix_released": "2026-10-20T19:00:25+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T12:33:40.961511+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1397/",
"https://plugins.svn.wordpress.org/surecart/tags/4.10.0/",
"https://wordpress.org/plugins/surecart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1396",
"url": "https://wpsec.com/vuln/WPSEC-2026-1396/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1396/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1396/index.md",
"title": "SureCart <= 4.9.6 - Unauthenticated Open Redirect via Checkout 'page_url' Metadata",
"description": "The SureCart plugin for WordPress is vulnerable to Open Redirect via the checkout 'page_url' metadata in all versions up to, and including, 4.9.6. This is due to the checkout redirect middleware using the client-controllable page_url value as a redirect target without validating it against allowed hosts. This makes it possible for unauthenticated attackers to redirect users to arbitrary external sites if they can successfully trick a victim into following a crafted link.",
"plugin": {
"slug": "surecart",
"name": "SureCart",
"full_name": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments",
"wordpress_org": "https://wordpress.org/plugins/surecart/",
"advisories_url": "https://wpsec.com/vuln/plugin/surecart/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/surecart"
},
"type": "REDIRECT",
"cwe": [
"CWE-601"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.10.0",
"to_inclusive": false
}
],
"text": [
"all versions before 4.10.0"
]
},
"introduced_in": null,
"fixed_in": "4.10.0",
"remediation": "Update to 4.10.0 or later.",
"fix_released": "2026-10-20T19:00:25+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T12:33:40.961511+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1396/",
"https://plugins.svn.wordpress.org/surecart/tags/4.10.0/",
"https://wordpress.org/plugins/surecart/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/surecart",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1395",
"url": "https://wpsec.com/vuln/WPSEC-2026-1395/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1395/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1395/index.md",
"title": "Pixel Manager for WooCommerce <= 2.2.2 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update via AJAX Actions",
"description": "The Pixel Tag Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the pmw_pixels_save, pmw_clean_debug_logs and pmw_notice_dismiss AJAX actions in all versions up to, and including, 2.2.2, due to a missing capability check in the admin_safe_ajax_call() function. That function relied only on is_admin(), which is true for every admin-ajax.php request, and on a pmw_ajax_nonce that the plugin printed in its admin notices on every wp-admin screen to any logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the plugin's tracking and conversion API settings (pixel IDs, API tokens, data-sharing options) and to clear its debug logs.",
"plugin": {
"slug": "pixel-manager-for-woocommerce",
"name": "Pixel Manager for WooCommerce",
"full_name": "Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels",
"wordpress_org": "https://wordpress.org/plugins/pixel-manager-for-woocommerce/",
"advisories_url": "https://wpsec.com/vuln/plugin/pixel-manager-for-woocommerce/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/pixel-manager-for-woocommerce"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.2.3",
"to_inclusive": false
}
],
"text": [
"all versions before 2.2.3"
]
},
"introduced_in": null,
"fixed_in": "2.2.3",
"remediation": "Update to 2.2.3 or later.",
"fix_released": "2026-10-20T18:43:14+00:00",
"published": "2026-10-21T19:42:05+00:00",
"updated": "2026-10-21T10:35:03.828747+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1395/",
"https://plugins.svn.wordpress.org/pixel-manager-for-woocommerce/tags/2.2.3/",
"https://wordpress.org/plugins/pixel-manager-for-woocommerce/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/pixel-manager-for-woocommerce",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1394",
"url": "https://wpsec.com/vuln/WPSEC-2026-1394/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1394/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1394/index.md",
"title": "LiteSpeed Cache <= 7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes",
"description": "The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in all versions from 7.6 up to, and including, 7.9.1. This is due to insufficient output escaping when the plugin rebuilds viewport (VPI) image tags to add the fetchpriority and decoding attributes: parsed attribute values are re-emitted inside double quotes without escaping, so a single-quoted value containing double quotes breaks out of the attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Exploitation requires Viewport Images to be in use for that page.",
"plugin": {
"slug": "litespeed-cache",
"name": "LiteSpeed Cache",
"full_name": "LiteSpeed Cache",
"wordpress_org": "https://wordpress.org/plugins/litespeed-cache/",
"advisories_url": "https://wpsec.com/vuln/plugin/litespeed-cache/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/litespeed-cache"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "7.6",
"from_inclusive": true,
"to": "7.9.2",
"to_inclusive": false
}
],
"text": [
"from 7.6 before 7.9.2"
]
},
"introduced_in": "7.6",
"fixed_in": "7.9.2",
"remediation": "Update to 7.9.2 or later.",
"fix_released": "2026-10-20T18:08:55+00:00",
"published": "2026-10-21T18:42:23+00:00",
"updated": "2026-10-21T12:33:12.120287+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1394/",
"https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/",
"https://wordpress.org/plugins/litespeed-cache/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/litespeed-cache",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1393",
"url": "https://wpsec.com/vuln/WPSEC-2026-1393/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1393/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1393/index.md",
"title": "LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Exposure via Preset Backup Files",
"description": "The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure via preset backup files in all versions from 5.3 up to, and including, 7.9.1. This is due to automatic preset backups being written as plain .data files, with predictable names built from a timestamp and the preset name, into the web-accessible wp-content/litespeed/auto-backup directory. Versions 7.9 and 7.9.1 block access to that directory only through an .htaccess file, which servers such as nginx do not apply. This makes it possible for unauthenticated attackers to download the plugin's full exported settings after an administrator has applied a preset. These settings can include the QUIC.cloud API key, object cache and CDN credentials, crawler cookies and the plugin's internal security hash. Version 7.9.2 writes new backups to protected PHP files without these secrets, but it does not remove existing backups. After updating, administrators should delete the wp-content/litespeed/auto-backup directory and rotate any credentials it held.",
"plugin": {
"slug": "litespeed-cache",
"name": "LiteSpeed Cache",
"full_name": "LiteSpeed Cache",
"wordpress_org": "https://wordpress.org/plugins/litespeed-cache/",
"advisories_url": "https://wpsec.com/vuln/plugin/litespeed-cache/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/litespeed-cache"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-538"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.9,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "5.3",
"from_inclusive": true,
"to": "7.9.2",
"to_inclusive": false
}
],
"text": [
"from 5.3 before 7.9.2"
]
},
"introduced_in": "5.3",
"fixed_in": "7.9.2",
"remediation": "Update to 7.9.2 or later.",
"fix_released": "2026-10-20T18:08:55+00:00",
"published": "2026-10-21T18:42:23+00:00",
"updated": "2026-10-21T12:33:12.120287+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1393/",
"https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/",
"https://wordpress.org/plugins/litespeed-cache/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/litespeed-cache",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1392",
"url": "https://wpsec.com/vuln/WPSEC-2026-1392/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1392/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1392/index.md",
"title": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.1.3 - Cross-Site Request Forgery to Port Setting Update",
"description": "The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'port' parameter in all versions up to, and including, 4.1.3, due to the base admin controller saving the 'port' option from POST data whenever 'is_settings_submitted' was present, on every WP All Import admin page, without nonce validation. This makes it possible for unauthenticated attackers to change the port the plugin uses to build its admin URLs and redirects, which can break the plugin's admin screens and import wizard, via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
"plugin": {
"slug": "wp-all-import",
"name": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
"full_name": "WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets",
"wordpress_org": "https://wordpress.org/plugins/wp-all-import/",
"advisories_url": "https://wpsec.com/vuln/plugin/wp-all-import/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wp-all-import"
},
"type": "CSRF",
"cwe": [
"CWE-352"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "4.1.4",
"to_inclusive": false
}
],
"text": [
"all versions before 4.1.4"
]
},
"introduced_in": null,
"fixed_in": "4.1.4",
"remediation": "Update to 4.1.4 or later.",
"fix_released": "2026-10-20T17:40:34+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:35:40.666359+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1392/",
"https://plugins.svn.wordpress.org/wp-all-import/tags/4.1.4/",
"https://wordpress.org/plugins/wp-all-import/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-all-import",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1391",
"url": "https://wpsec.com/vuln/WPSEC-2026-1391/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1391/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1391/index.md",
"title": "GeoDirectory <= 2.8.193 - Unauthenticated Authorization Bypass to Guest Listing Ownership",
"description": "The GeoDirectory plugin for WordPress is vulnerable to an authorization bypass via the listing edit permission check (GeoDir_Post_Data::can_edit) in all versions up to, and including, 2.8.193. This is due to a loose comparison between the listing author ID and the current user ID, which runs before the guest ownership cookie check. As a result, logged-out visitors (user ID 0) match any listing whose author ID is 0, such as listings started by guests. This makes it possible for unauthenticated attackers to edit, auto-save and upload files to guest-authored listings they do not own, on sites where guest listing submission is enabled.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-863"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.6,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.194",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.194"
]
},
"introduced_in": null,
"fixed_in": "2.8.194",
"remediation": "Update to 2.8.194 or later.",
"fix_released": "2026-10-20T17:17:09+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:34:26.900159+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1391/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1390",
"url": "https://wpsec.com/vuln/WPSEC-2026-1390/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1390/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1390/index.md",
"title": "GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Path Traversal in Listing Media",
"description": "The GeoDirectory plugin for WordPress is vulnerable to Path Traversal via listing image and file field URLs in all versions up to, and including, 2.8.193. This is due to the get_external_media function turning a geodir_temp URL into a filesystem path with a plain string replacement that does not block '../' sequences. The resolved file is then moved into the uploads directory and unlinked. This makes it possible for authenticated attackers, with Subscriber-level access and above, who can submit listings to delete files outside the temporary folder, and to copy them onto their own listing. Only files whose extension is allowed for the field can be targeted (image types by default), such as media uploaded by other users.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "FILE DELETION",
"cwe": [
"CWE-22"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 7.6,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"severity": "High"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.194",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.194"
]
},
"introduced_in": null,
"fixed_in": "2.8.194",
"remediation": "Update to 2.8.194 or later.",
"fix_released": "2026-10-20T17:17:09+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:34:26.900159+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1390/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1389",
"url": "https://wpsec.com/vuln/WPSEC-2026-1389/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1389/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1389/index.md",
"title": "GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference to Listing Attachment Modification",
"description": "The GeoDirectory plugin for WordPress is vulnerable to Insecure Direct Object Reference via the attachment ID in listing image and file field values in all versions up to, and including, 2.8.193. This is due to the update_attachment function updating the attachment record named by a user-supplied ID without checking that the attachment belongs to the listing being saved. This makes it possible for authenticated attackers, with Subscriber-level access and above, who can submit listings to change the title, caption, order, featured flag and approval status of images and files attached to other users' listings.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.194",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.194"
]
},
"introduced_in": null,
"fixed_in": "2.8.194",
"remediation": "Update to 2.8.194 or later.",
"fix_released": "2026-10-20T17:17:09+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:34:26.900159+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1389/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1388",
"url": "https://wpsec.com/vuln/WPSEC-2026-1388/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1388/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1388/index.md",
"title": "GeoDirectory <= 2.8.193 - Unauthenticated Sensitive Information Exposure via REST Marker Popup and Recently Viewed Listings",
"description": "The GeoDirectory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.193 due to missing visibility checks on the REST API map marker popup endpoint and the recently viewed listings AJAX handler, which render listings by ID regardless of their status. This makes it possible for unauthenticated attackers to view the content of draft, pending, private and revision listings. Listing field shortcodes such as [gd_post_meta id=X] were similarly affected for authenticated users with Contributor-level access and above.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.194",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.194"
]
},
"introduced_in": null,
"fixed_in": "2.8.194",
"remediation": "Update to 2.8.194 or later.",
"fix_released": "2026-10-20T17:17:09+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:34:26.900159+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1388/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1387",
"url": "https://wpsec.com/vuln/WPSEC-2026-1387/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1387/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1387/index.md",
"title": "GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map and Post Badge Shortcode Attributes",
"description": "The GeoDirectory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' and 'height' attributes of the gd_map shortcode and the 'cta' and 'link' attributes of the gd_post_badge shortcode in all versions up to, and including, 2.8.193. This is due to insufficient input sanitization and output escaping: the map dimensions are echoed into style attributes unescaped, the 'cta' value is placed in an inline onclick handler with only esc_attr(), and the link URL is not checked for unsafe schemes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "geodirectory",
"name": "GeoDirectory",
"full_name": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
"wordpress_org": "https://wordpress.org/plugins/geodirectory/",
"advisories_url": "https://wpsec.com/vuln/plugin/geodirectory/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/geodirectory"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.8.194",
"to_inclusive": false
}
],
"text": [
"all versions before 2.8.194"
]
},
"introduced_in": null,
"fixed_in": "2.8.194",
"remediation": "Update to 2.8.194 or later.",
"fix_released": "2026-10-20T17:17:09+00:00",
"published": "2026-10-21T17:49:01+00:00",
"updated": "2026-10-21T10:34:26.900159+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1387/",
"https://plugins.svn.wordpress.org/geodirectory/tags/2.8.194/",
"https://wordpress.org/plugins/geodirectory/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/geodirectory",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1386",
"url": "https://wpsec.com/vuln/WPSEC-2026-1386/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1386/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1386/index.md",
"title": "Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Unauthenticated Missing Authorization to archive.org Credential Validation",
"description": "The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to unauthorized access via the archive.org credential validation routine in all versions up to, and including, 1.4.2, due to a missing capability check in the validate_archive_org_keys() function, which runs on admin_init and acts only on the 'page' and 'settings-updated' query arguments. Because admin_init fires on requests to admin-ajax.php before any login check, this makes it possible for unauthenticated attackers to make the site send its stored archive.org access and secret keys to archive.org for validation as often as they like, and to overwrite the stored credential-validity flag with the result. If those requests fail, for example under rate limiting, the credentials are marked invalid and the site falls back to unauthenticated snapshot mode.",
"plugin": {
"slug": "internet-archive-wayback-machine-link-fixer",
"name": "Internet Archive Wayback Machine Link Fixer",
"full_name": "Internet Archive Wayback Machine Link Fixer",
"wordpress_org": "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/",
"advisories_url": "https://wpsec.com/vuln/plugin/internet-archive-wayback-machine-link-fixer/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.5.0",
"to_inclusive": false
}
],
"text": [
"all versions before 1.5.0"
]
},
"introduced_in": null,
"fixed_in": "1.5.0",
"remediation": "Update to 1.5.0 or later.",
"fix_released": "2026-10-20T14:51:06+00:00",
"published": "2026-10-21T14:52:44+00:00",
"updated": "2026-10-21T10:35:11.876976+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1386/",
"https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/",
"https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1385",
"url": "https://wpsec.com/vuln/WPSEC-2026-1385/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1385/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1385/index.md",
"title": "Internet Archive Wayback Machine Link Fixer <= 1.4.2 - Improper Certificate Validation Leading to archive.org Credential Exposure",
"description": "The Internet Archive Wayback Machine Link Fixer plugin for WordPress is vulnerable to improper certificate validation via the snapshot creation request in all versions up to, and including, 1.4.2, due to the request to the Wayback Machine save endpoint being sent with 'sslverify' set to false while it carries the site's archive.org access and secret keys in an Authorization header. This makes it possible for unauthenticated attackers who can intercept traffic between the site and archive.org to impersonate archive.org and capture the site's archive.org API credentials.",
"plugin": {
"slug": "internet-archive-wayback-machine-link-fixer",
"name": "Internet Archive Wayback Machine Link Fixer",
"full_name": "Internet Archive Wayback Machine Link Fixer",
"wordpress_org": "https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/",
"advisories_url": "https://wpsec.com/vuln/plugin/internet-archive-wayback-machine-link-fixer/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-295"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.5.0",
"to_inclusive": false
}
],
"text": [
"all versions before 1.5.0"
]
},
"introduced_in": null,
"fixed_in": "1.5.0",
"remediation": "Update to 1.5.0 or later.",
"fix_released": "2026-10-20T14:51:06+00:00",
"published": "2026-10-21T14:52:44+00:00",
"updated": "2026-10-21T10:35:11.876976+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1385/",
"https://plugins.svn.wordpress.org/internet-archive-wayback-machine-link-fixer/tags/1.5.0/",
"https://wordpress.org/plugins/internet-archive-wayback-machine-link-fixer/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/internet-archive-wayback-machine-link-fixer",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1384",
"url": "https://wpsec.com/vuln/WPSEC-2026-1384/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1384/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1384/index.md",
"title": "Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Form Field Type",
"description": "The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the field type of saved add-on forms in all versions up to, and including, 3.1.8, due to insufficient input sanitization and output escaping. The field type is saved without sanitization and printed unescaped into an HTML class attribute in the cart item meta template. This makes it possible for authenticated attackers with Shop Manager-level access and above to inject arbitrary web scripts that execute when a user views the cart or checkout page after adding a product that uses the form. This only matters on multisite installations and on installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "woo-custom-product-addons",
"name": "Product Addons for Woocommerce – Product Options with Custom Fields",
"full_name": "Product Addons for Woocommerce – Product Options with Custom Fields",
"wordpress_org": "https://wordpress.org/plugins/woo-custom-product-addons/",
"advisories_url": "https://wpsec.com/vuln/plugin/woo-custom-product-addons/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/woo-custom-product-addons"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.1.9",
"to_inclusive": false
}
],
"text": [
"all versions before 3.1.9"
]
},
"introduced_in": null,
"fixed_in": "3.1.9",
"remediation": "Update to 3.1.9 or later.",
"fix_released": "2026-10-20T13:45:27+00:00",
"published": "2026-10-21T14:52:44+00:00",
"updated": "2026-10-21T10:34:05.339229+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1384/",
"https://plugins.svn.wordpress.org/woo-custom-product-addons/tags/3.1.9/",
"https://wordpress.org/plugins/woo-custom-product-addons/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-custom-product-addons",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1383",
"url": "https://wpsec.com/vuln/WPSEC-2026-1383/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1383/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1383/index.md",
"title": "Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter",
"description": "The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'customer_id' parameter of the public order creation REST endpoint (POST /wp-json/booktics/v1/orders) in all versions up to, and including, 1.0.30, due to missing validation that the supplied customer ID belongs to the current user. The order and its appointments are created under the named customer record, and the response returns that customer's name, email address and phone number. This makes it possible for unauthenticated attackers to enumerate customer IDs to obtain other customers' personal details and to place bookings under other customers' records.",
"plugin": {
"slug": "booktics",
"name": "Booktics – Appointment Booking Calendar for Service Businesses",
"full_name": "Booktics – Appointment Booking Calendar for Service Businesses",
"wordpress_org": "https://wordpress.org/plugins/booktics/",
"advisories_url": "https://wpsec.com/vuln/plugin/booktics/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/booktics"
},
"type": "IDOR",
"cwe": [
"CWE-639"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.5,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.0.31",
"to_inclusive": false
}
],
"text": [
"all versions before 1.0.31"
]
},
"introduced_in": null,
"fixed_in": "1.0.31",
"remediation": "Update to 1.0.31 or later.",
"fix_released": "2026-10-19T17:58:18+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:34:04.686429+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1383/",
"https://plugins.svn.wordpress.org/booktics/tags/1.0.31/",
"https://wordpress.org/plugins/booktics/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/booktics",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Not seen",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1382",
"url": "https://wpsec.com/vuln/WPSEC-2026-1382/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1382/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1382/index.md",
"title": "Booking Package <= 1.7.32 - Unauthenticated User Registration Bypass via 'createUser' Action",
"description": "The Booking Package plugin for WordPress is vulnerable to unauthorized user registration via the 'createUser' mode of the public AJAX handler in all versions up to, and including, 1.7.32, due to the handler not checking server-side whether member functions and customer registration are enabled. This makes it possible for unauthenticated attackers to create user accounts with the plugin's member role even when customer registration has been disabled, on sites where the plugin's member features are licensed.",
"plugin": {
"slug": "booking-package",
"name": "Booking Package",
"full_name": "Booking Package",
"wordpress_org": "https://wordpress.org/plugins/booking-package/",
"advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.33",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.33"
]
},
"introduced_in": null,
"fixed_in": "1.7.33",
"remediation": "Update to 1.7.33 or later.",
"fix_released": "2026-10-19T04:42:36+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:59.007581+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1382/",
"https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
"https://wordpress.org/plugins/booking-package/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1381",
"url": "https://wpsec.com/vuln/WPSEC-2026-1381/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1381/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1381/index.md",
"title": "Booking Package <= 1.7.32 - Unauthenticated Verification Code Bypass",
"description": "The Booking Package plugin for WordPress is vulnerable to Authentication Bypass of its e-mail and SMS verification code step in all versions up to, and including, 1.7.32, due to a completed verification not being bound to the e-mail address, phone number or calendar it was issued for, and to the verification code check having no limit on failed attempts. This makes it possible for unauthenticated attackers to make bookings or register member accounts with e-mail addresses or phone numbers they do not control, on sites that enable verification codes.",
"plugin": {
"slug": "booking-package",
"name": "Booking Package",
"full_name": "Booking Package",
"wordpress_org": "https://wordpress.org/plugins/booking-package/",
"advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
},
"type": "AUTHBYPASS",
"cwe": [
"CWE-287"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.33",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.33"
]
},
"introduced_in": null,
"fixed_in": "1.7.33",
"remediation": "Update to 1.7.33 or later.",
"fix_released": "2026-10-19T04:42:36+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:59.007581+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1381/",
"https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
"https://wordpress.org/plugins/booking-package/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1380",
"url": "https://wpsec.com/vuln/WPSEC-2026-1380/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1380/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1380/index.md",
"title": "Booking Package <= 1.7.32 - Unauthenticated Price Manipulation via Hotel Room Amounts and Cross-Calendar Services",
"description": "The Booking Package plugin for WordPress is vulnerable to price manipulation via the public booking submission and payment intent creation in all versions up to, and including, 1.7.32, due to the plugin taking the per-room 'personAmount' and 'optionsAmount' values of accommodation (hotel) bookings from the client-supplied 'json' parameter and using them to compute the total cost and the amount charged, and due to service and guest records being looked up by key alone without checking that they belong to the booked calendar. This makes it possible for unauthenticated attackers to lower the price charged for a booking.",
"plugin": {
"slug": "booking-package",
"name": "Booking Package",
"full_name": "Booking Package",
"wordpress_org": "https://wordpress.org/plugins/booking-package/",
"advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
},
"type": "BYPASS",
"cwe": [
"CWE-472"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.33",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.33"
]
},
"introduced_in": null,
"fixed_in": "1.7.33",
"remediation": "Update to 1.7.33 or later.",
"fix_released": "2026-10-19T04:42:36+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:59.007581+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1380/",
"https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
"https://wordpress.org/plugins/booking-package/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1379",
"url": "https://wpsec.com/vuln/WPSEC-2026-1379/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1379/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1379/index.md",
"title": "Booking Package <= 1.7.32 - Unauthenticated Payment Bypass via Stripe Payment Amount Mismatch and Payment Reuse",
"description": "The Booking Package plugin for WordPress is vulnerable to payment bypass via the online payment step of the public booking submission in all versions up to, and including, 1.7.32, due to the plugin accepting a Stripe PaymentIntent based only on its ID and status, without confirming that the intent's amount matches the booking amount, and not checking whether a Stripe or PayPal payment had already been used for another booking. This makes it possible for unauthenticated attackers to pay for a cheaper booking and use that Stripe payment to complete a more expensive one, or to reuse one payment for several bookings, when online payment is enabled.",
"plugin": {
"slug": "booking-package",
"name": "Booking Package",
"full_name": "Booking Package",
"wordpress_org": "https://wordpress.org/plugins/booking-package/",
"advisories_url": "https://wpsec.com/vuln/plugin/booking-package/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/booking-package"
},
"type": "BYPASS",
"cwe": [
"CWE-345"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "1.7.33",
"to_inclusive": false
}
],
"text": [
"all versions before 1.7.33"
]
},
"introduced_in": null,
"fixed_in": "1.7.33",
"remediation": "Update to 1.7.33 or later.",
"fix_released": "2026-10-19T04:42:36+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:59.007581+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1379/",
"https://plugins.svn.wordpress.org/booking-package/tags/1.7.33/",
"https://wordpress.org/plugins/booking-package/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-package",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1378",
"url": "https://wpsec.com/vuln/WPSEC-2026-1378/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1378/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1378/index.md",
"title": "WP Booking System <= 2.1.0.4 - Authenticated (Subscriber+) Missing Authorization to Booking Modification via AJAX Actions",
"description": "The WP Booking System plugin for WordPress is vulnerable to unauthorized access and modification of data via several booking management AJAX actions in all versions up to, and including, 2.1.0.4, due to a missing check that the current user may access the calendar a booking belongs to. The affected actions open booking details, email the customer, edit booking details and scheduled actions, and add or delete booking notes. This makes it possible for authenticated attackers, with Subscriber-level access and above, who have been given access to at least one calendar, to view and modify bookings that belong to calendars they are not allowed to access.",
"plugin": {
"slug": "wp-booking-system",
"name": "WP Booking System",
"full_name": "WP Booking System – Booking Calendar",
"wordpress_org": "https://wordpress.org/plugins/wp-booking-system/",
"advisories_url": "https://wpsec.com/vuln/plugin/wp-booking-system/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wp-booking-system"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.1.0.5",
"to_inclusive": false
}
],
"text": [
"all versions before 2.1.0.5"
]
},
"introduced_in": null,
"fixed_in": "2.1.0.5",
"remediation": "Update to 2.1.0.5 or later.",
"fix_released": "2026-10-19T10:22:15+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:45.615122+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1378/",
"https://plugins.svn.wordpress.org/wp-booking-system/tags/2.1.0.5/",
"https://wordpress.org/plugins/wp-booking-system/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-booking-system",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1377",
"url": "https://wpsec.com/vuln/WPSEC-2026-1377/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1377/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1377/index.md",
"title": "Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via podcast_playlist Shortcode 'type' Attribute",
"description": "The Seriously Simple Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [podcast_playlist] shortcode (compact player style) in all versions up to, and including, 3.17.0, due to insufficient input validation and output escaping. The attribute value is used as an HTML tag name and is passed only through esc_attr(), which does not stop spaces and attribute syntax. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "seriously-simple-podcasting",
"name": "Seriously Simple Podcasting",
"full_name": "Seriously Simple Podcasting",
"wordpress_org": "https://wordpress.org/plugins/seriously-simple-podcasting/",
"advisories_url": "https://wpsec.com/vuln/plugin/seriously-simple-podcasting/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.17.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.17.1"
]
},
"introduced_in": null,
"fixed_in": "3.17.1",
"remediation": "Update to 3.17.1 or later.",
"fix_released": "2026-10-19T10:34:53+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:40.983929+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1377/",
"https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/",
"https://wordpress.org/plugins/seriously-simple-podcasting/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1376",
"url": "https://wpsec.com/vuln/WPSEC-2026-1376/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1376/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1376/index.md",
"title": "Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Sensitive Information Exposure of Private and Draft Posts via podcast_episode Shortcode",
"description": "The Seriously Simple Podcasting plugin for WordPress is vulnerable to Sensitive Information Exposure via the [podcast_episode] shortcode in all versions up to, and including, 3.17.0, due to the plugin rendering the title, content, excerpt and player of any post ID passed in the 'episode' attribute without checking its post type, status or whether the current user may read it. This makes it possible for authenticated attackers with contributor-level access and above to read the content of private, draft and pending posts, and the media of non-public episodes, that belong to other users.",
"plugin": {
"slug": "seriously-simple-podcasting",
"name": "Seriously Simple Podcasting",
"full_name": "Seriously Simple Podcasting",
"wordpress_org": "https://wordpress.org/plugins/seriously-simple-podcasting/",
"advisories_url": "https://wpsec.com/vuln/plugin/seriously-simple-podcasting/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.17.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.17.1"
]
},
"introduced_in": null,
"fixed_in": "3.17.1",
"remediation": "Update to 3.17.1 or later.",
"fix_released": "2026-10-19T10:34:53+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:40.983929+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1376/",
"https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/",
"https://wordpress.org/plugins/seriously-simple-podcasting/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1375",
"url": "https://wpsec.com/vuln/WPSEC-2026-1375/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1375/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1375/index.md",
"title": "Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Missing Authorization to Edit-Context Episode Data via REST API",
"description": "The Seriously Simple Podcasting plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 3.17.0 due to a missing capability check on the 'context' parameter of the episodes REST collection endpoint. Only a read-permission check was applied per episode, so context=edit was honored for any caller. This makes it possible for unauthenticated attackers to retrieve edit-context fields, such as raw content of password-protected episodes, that should only be available to users who can edit them.",
"plugin": {
"slug": "seriously-simple-podcasting",
"name": "Seriously Simple Podcasting",
"full_name": "Seriously Simple Podcasting",
"wordpress_org": "https://wordpress.org/plugins/seriously-simple-podcasting/",
"advisories_url": "https://wpsec.com/vuln/plugin/seriously-simple-podcasting/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.17.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.17.1"
]
},
"introduced_in": null,
"fixed_in": "3.17.1",
"remediation": "Update to 3.17.1 or later.",
"fix_released": "2026-10-19T10:34:53+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:40.983929+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1375/",
"https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/",
"https://wordpress.org/plugins/seriously-simple-podcasting/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1374",
"url": "https://wpsec.com/vuln/WPSEC-2026-1374/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1374/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1374/index.md",
"title": "Seriously Simple Podcasting <= 3.17.0 - Unauthenticated Sensitive Information Exposure of Password-Protected Episode Media via REST API and Playlist AJAX",
"description": "The Seriously Simple Podcasting plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API episode fields (download link, player link, player and meta), the playlist AJAX response and the episode download route in all versions up to, and including, 3.17.0, due to the media URL and excerpt of an episode being returned without checking whether the episode is password-protected. This makes it possible for unauthenticated attackers to obtain the media file URLs and excerpt text of password-protected episodes without knowing the password.",
"plugin": {
"slug": "seriously-simple-podcasting",
"name": "Seriously Simple Podcasting",
"full_name": "Seriously Simple Podcasting",
"wordpress_org": "https://wordpress.org/plugins/seriously-simple-podcasting/",
"advisories_url": "https://wpsec.com/vuln/plugin/seriously-simple-podcasting/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 5.3,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.17.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.17.1"
]
},
"introduced_in": null,
"fixed_in": "3.17.1",
"remediation": "Update to 3.17.1 or later.",
"fix_released": "2026-10-19T10:34:53+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:40.983929+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1374/",
"https://plugins.svn.wordpress.org/seriously-simple-podcasting/tags/3.17.1/",
"https://wordpress.org/plugins/seriously-simple-podcasting/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/seriously-simple-podcasting",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1373",
"url": "https://wpsec.com/vuln/WPSEC-2026-1373/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1373/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1373/index.md",
"title": "Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via DNS Prefetch and Font Preload URLs",
"description": "The Speed Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the DNS prefetch URLs and font preload URLs settings (including values loaded through the settings import) in all versions up to, and including, 7.8.4, due to insufficient input sanitization and output escaping when the stored URLs are printed into tags in the page head. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts that execute on every front-end page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "sg-cachepress",
"name": "Speed Optimizer",
"full_name": "Speed Optimizer – The All-In-One Performance-Boosting Plugin",
"wordpress_org": "https://wordpress.org/plugins/sg-cachepress/",
"advisories_url": "https://wpsec.com/vuln/plugin/sg-cachepress/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/sg-cachepress"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": "5.6.0",
"from_inclusive": true,
"to": "7.8.5",
"to_inclusive": false
}
],
"text": [
"from 5.6.0 before 7.8.5"
]
},
"introduced_in": "5.6.0",
"fixed_in": "7.8.5",
"remediation": "Update to 7.8.5 or later.",
"fix_released": "2026-10-20T07:22:18+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:38.193091+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1373/",
"https://plugins.svn.wordpress.org/sg-cachepress/tags/7.8.5/",
"https://wordpress.org/plugins/sg-cachepress/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/sg-cachepress",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1372",
"url": "https://wpsec.com/vuln/WPSEC-2026-1372/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1372/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1372/index.md",
"title": "Speed Optimizer <= 7.8.4 - Authenticated (Administrator+) Missing Authorization to Network Option Update via Enable/Disable Option REST Routes",
"description": "The Speed Optimizer plugin for WordPress is vulnerable to unauthorized modification of data via the enable-option and disable-option REST routes in all versions up to, and including, 7.8.4, due to missing option key validation and a missing manage_network_options capability check in those handlers, which also trusted a client-supplied is_multisite flag. This makes it possible for authenticated attackers with site administrator-level access on a multisite network to change network-wide plugin settings, such as the per-site feature permissions and network defaults, and to set arbitrary site or network options outside the plugin's own settings to 1. The network-level impact only applies to multisite installations.",
"plugin": {
"slug": "sg-cachepress",
"name": "Speed Optimizer",
"full_name": "Speed Optimizer – The All-In-One Performance-Boosting Plugin",
"wordpress_org": "https://wordpress.org/plugins/sg-cachepress/",
"advisories_url": "https://wpsec.com/vuln/plugin/sg-cachepress/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/sg-cachepress"
},
"type": "NO AUTHORISATION",
"cwe": [
"CWE-862"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 2.2,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "7.8.5",
"to_inclusive": false
}
],
"text": [
"all versions before 7.8.5"
]
},
"introduced_in": null,
"fixed_in": "7.8.5",
"remediation": "Update to 7.8.5 or later.",
"fix_released": "2026-10-20T07:22:18+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:38.193091+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1372/",
"https://plugins.svn.wordpress.org/sg-cachepress/tags/7.8.5/",
"https://wordpress.org/plugins/sg-cachepress/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/sg-cachepress",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1371",
"url": "https://wpsec.com/vuln/WPSEC-2026-1371/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1371/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1371/index.md",
"title": "Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Typed Text",
"description": "The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading block's typed text feature in all versions up to, and including, 3.8.0 due to the front-end script passing the heading's decoded text content to Typed.js without HTML escaping, allowing entity-encoded markup to be reinserted as HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "kadence-blocks",
"name": "Kadence Blocks",
"full_name": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
"wordpress_org": "https://wordpress.org/plugins/kadence-blocks/",
"advisories_url": "https://wpsec.com/vuln/plugin/kadence-blocks/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/kadence-blocks"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8.0.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8.0.1"
]
},
"introduced_in": null,
"fixed_in": "3.8.0.1",
"remediation": "Update to 3.8.0.1 or later.",
"fix_released": "2026-10-19T19:31:10+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:26.041066+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1371/",
"https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.0.1/",
"https://wordpress.org/plugins/kadence-blocks/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/kadence-blocks",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1370",
"url": "https://wpsec.com/vuln/WPSEC-2026-1370/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1370/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1370/index.md",
"title": "Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up Block Prefix, Suffix and Separator",
"description": "The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Count Up block's prefix, suffix, separator and decimal settings in all versions up to, and including, 3.8.0 due to insufficient output escaping in the front-end count-up script, which inserted these values into a screen-reader element via innerHTML and passed them unescaped to the CountUp library. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "kadence-blocks",
"name": "Kadence Blocks",
"full_name": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
"wordpress_org": "https://wordpress.org/plugins/kadence-blocks/",
"advisories_url": "https://wpsec.com/vuln/plugin/kadence-blocks/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/kadence-blocks"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8.0.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8.0.1"
]
},
"introduced_in": null,
"fixed_in": "3.8.0.1",
"remediation": "Update to 3.8.0.1 or later.",
"fix_released": "2026-10-19T19:31:10+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:26.041066+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1370/",
"https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.0.1/",
"https://wordpress.org/plugins/kadence-blocks/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/kadence-blocks",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1369",
"url": "https://wpsec.com/vuln/WPSEC-2026-1369/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1369/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1369/index.md",
"title": "Kadence Blocks <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar Block Number Prefix and Suffix",
"description": "The Kadence Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Progress Bar block's numberPrefix and numberSuffix attributes in all versions up to, and including, 3.8.0 due to insufficient output escaping. The values were only passed through esc_attr(), which leaves existing HTML entities as they are, before being handed to the front-end progress bar script. That script decoded the entities and wrote the result into the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"plugin": {
"slug": "kadence-blocks",
"name": "Kadence Blocks",
"full_name": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
"wordpress_org": "https://wordpress.org/plugins/kadence-blocks/",
"advisories_url": "https://wpsec.com/vuln/plugin/kadence-blocks/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/kadence-blocks"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.4,
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.8.0.1",
"to_inclusive": false
}
],
"text": [
"all versions before 3.8.0.1"
]
},
"introduced_in": null,
"fixed_in": "3.8.0.1",
"remediation": "Update to 3.8.0.1 or later.",
"fix_released": "2026-10-19T19:31:10+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T13:33:26.041066+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1369/",
"https://plugins.svn.wordpress.org/kadence-blocks/tags/3.8.0.1/",
"https://wordpress.org/plugins/kadence-blocks/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/kadence-blocks",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "High",
"affected_versions": "High",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1368",
"url": "https://wpsec.com/vuln/WPSEC-2026-1368/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1368/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1368/index.md",
"title": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.70.0 - Unauthenticated Full Path Disclosure via Google Tag Gateway Proxy Configuration File",
"description": "The Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing plugin for WordPress is vulnerable to Full Path Disclosure via the Google Tag Gateway proxy configuration file in all versions up to, and including, 1.70.0, due to the file being written to a predictable location (uploads/pmw-gtg/config-.json, with a copy in the plugin directory) with the absolute log directory and WP_CONTENT_DIR paths in it, guarded only by an .htaccess rule that nginx ignores. This makes it possible for unauthenticated attackers to retrieve the full server path of the installation on nginx-based sites that use the Google Tag Gateway, which can help with other attacks.",
"plugin": {
"slug": "woocommerce-google-adwords-conversion-tracking-tag",
"name": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing",
"full_name": "Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing",
"wordpress_org": "https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/",
"advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-google-adwords-conversion-tracking-tag/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-google-adwords-conversion-tracking-tag"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-200"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": "1.53.0",
"from_inclusive": true,
"to": "1.71.0",
"to_inclusive": false
}
],
"text": [
"from 1.53.0 before 1.71.0"
]
},
"introduced_in": "1.53.0",
"fixed_in": "1.71.0",
"remediation": "Update to 1.71.0 or later.",
"fix_released": "2026-10-20T13:16:42+00:00",
"published": "2026-10-21T13:44:54+00:00",
"updated": "2026-10-21T11:59:28.892154+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1368/",
"https://plugins.svn.wordpress.org/woocommerce-google-adwords-conversion-tracking-tag/tags/1.71.0/",
"https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-google-adwords-conversion-tracking-tag",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Medium",
"affected_versions": "Medium",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1367",
"url": "https://wpsec.com/vuln/WPSEC-2026-1367/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1367/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1367/index.md",
"title": "We’re Open! <= 2.6 - Unauthenticated Reflected Cross-Site Scripting via 'content' Parameter",
"description": "The We’re Open! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'content' parameter of the we_are_open_wp_ajax AJAX action in all versions up to, and including, 2.6, due to insufficient input sanitization and output escaping. The submitted content is returned unfiltered in a JSON response served as text/html. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a user's browser if they can trick the user into submitting a crafted request, such as by visiting a malicious page.",
"plugin": {
"slug": "opening-hours",
"name": "We’re Open!",
"full_name": "We’re Open!",
"wordpress_org": "https://wordpress.org/plugins/opening-hours/",
"advisories_url": "https://wpsec.com/vuln/plugin/opening-hours/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/opening-hours"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 6.1,
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "2.7",
"to_inclusive": false
}
],
"text": [
"all versions before 2.7"
]
},
"introduced_in": null,
"fixed_in": "2.7",
"remediation": "Update to 2.7 or later.",
"fix_released": "2026-10-20T12:40:59+00:00",
"published": "2026-10-21T12:44:50+00:00",
"updated": "2026-10-21T10:35:00.715747+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1367/",
"https://plugins.svn.wordpress.org/opening-hours/tags/2.7/",
"https://wordpress.org/plugins/opening-hours/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/opening-hours",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "Low",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1366",
"url": "https://wpsec.com/vuln/WPSEC-2026-1366/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1366/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1366/index.md",
"title": "Logo and Address Widget with Schema <= 2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Title and Address Fields",
"description": "The Logo and Address Widget with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title and address fields (address lines, city, state and ZIP) in all versions up to, and including, 2.8. This is due to insufficient input sanitization and output escaping: the widget title is saved and printed without any sanitization, and the address fields are HTML-entity-decoded with html_entity_decode() before being printed. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that execute whenever a user accesses a page displaying the widget. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
"plugin": {
"slug": "logo-and-address-widget-with-schema",
"name": "Logo and Address Widget with Schema",
"full_name": "Logo and Address Widget with Schema",
"wordpress_org": "https://wordpress.org/plugins/logo-and-address-widget-with-schema/",
"advisories_url": "https://wpsec.com/vuln/plugin/logo-and-address-widget-with-schema/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/logo-and-address-widget-with-schema"
},
"type": "XSS",
"cwe": [
"CWE-79"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 4.4,
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"severity": "Medium"
},
"affected": {
"ranges": [
{
"from": null,
"from_inclusive": true,
"to": "3.0",
"to_inclusive": false
}
],
"text": [
"all versions before 3.0"
]
},
"introduced_in": null,
"fixed_in": "3.0",
"remediation": "Update to 3.0 or later.",
"fix_released": "2026-10-19T09:15:08+00:00",
"published": "2026-10-21T12:44:50+00:00",
"updated": "2026-10-21T12:34:14.610396+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1366/",
"https://plugins.svn.wordpress.org/logo-and-address-widget-with-schema/tags/3.0/",
"https://wordpress.org/plugins/logo-and-address-widget-with-schema/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/logo-and-address-widget-with-schema",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1365",
"url": "https://wpsec.com/vuln/WPSEC-2026-1365/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1365/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1365/index.md",
"title": "Team Manager <= 2.6.8 - Unauthenticated Sensitive Information Exposure via Debug Log File",
"description": "The Dynamic Team Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the debug log file in all versions up to, and including, 2.6.8. When debug logging is enabled, the plugin writes the log to a fixed, predictable, web-accessible path (wp-content/uploads/wp-team-manager/logs/wtm.log) and does nothing to block direct access. The log records Profile Sync webhook URLs, request signature headers and team member field values. This makes it possible for unauthenticated attackers to download the log and read this data.",
"plugin": {
"slug": "wp-team-manager",
"name": "Team Manager",
"full_name": "Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode",
"wordpress_org": "https://wordpress.org/plugins/wp-team-manager/",
"advisories_url": "https://wpsec.com/vuln/plugin/wp-team-manager/",
"attacksurface": "https://attacksurface.wpsec.com/plugin/wp-team-manager"
},
"type": "SENSITIVE DATA DISCLOSURE",
"cwe": [
"CWE-532"
],
"cve": [],
"cvss": {
"version": "3.1",
"score": 3.7,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"severity": "Low"
},
"affected": {
"ranges": [
{
"from": "2.3.10",
"from_inclusive": true,
"to": "2.6.9",
"to_inclusive": false
}
],
"text": [
"from 2.3.10 before 2.6.9"
]
},
"introduced_in": "2.3.10",
"fixed_in": "2.6.9",
"remediation": "Update to 2.6.9 or later.",
"fix_released": "2026-10-20T03:39:26+00:00",
"published": "2026-10-21T12:44:50+00:00",
"updated": "2026-10-21T12:34:00.250787+00:00",
"also_published_as": null,
"references": [
"https://wpsec.com/vuln/WPSEC-2026-1365/",
"https://plugins.svn.wordpress.org/wp-team-manager/tags/2.6.9/",
"https://wordpress.org/plugins/wp-team-manager/"
],
"attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-team-manager",
"source": "WPSec",
"license": {
"name": "CC BY 4.0",
"url": "https://creativecommons.org/licenses/by/4.0/"
},
"usage": {
"plugin": "Low",
"affected_versions": "None seen",
"as_of": "2026-10-22"
}
},
{
"id": "WPSEC-2026-1364",
"url": "https://wpsec.com/vuln/WPSEC-2026-1364/",
"json_url": "https://wpsec.com/vuln/WPSEC-2026-1364/advisory.json",
"markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1364/index.md",
"title": "Team Manager <= 2.6.8 - Authenticated (Contributor+) CSS Injection via 'bg_color' and 'social_color' Shortcode Attributes",
"description": "The Dynamic Team Manager plugin for WordPress is vulnerable to CSS Injection via the 'bg_color' and 'social_color' attributes of the [team_manager] shortcode in all versions up to, and including, 2.6.8, due to insufficient validation of the supplied color values, which are printed inside an inline