CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- phuongwebo webo mcpWordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability6.8 Medium
- precisionwp backupeaseWordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability7.5 High
- esteban stifli backup toolsWordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability7.5 High
- jose conti mcp content manager liteWordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability5.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- themerex addonsWordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themerex addonsWordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- webtoffee wordpress backup & migrationWordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability7.5 High
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- ad inserter inserter, spacetime ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- omnisend newsletters, email marketing, sms and popups by omnisendWordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- exactly www ewww image optimizerWordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess givewpWordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- happyformsWordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability7.1 High
- yoohw studio blacklist manager – woocommerce anti-fraud, blacklist & checkout verificationWordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- brainstorm force cartflowsWordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability8.8 High
- man4toman parsi dateWordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- kingaddons.com king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability6.5 Medium
- themefic ultimate addons for contact form 7WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability7.2 High
- keywordrush content eggWordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability7.2 High
- themifyme themify builderWordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability8.8 High
- nexcess givewpWordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- posimyth the plus addons for elementor page builder liteWordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vidish category discount woocommerceWordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability7.6 High
- melapress admin notices managerWordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability7.6 High
- all in one wp security & firewall team in one wp security & firewall, david anderson / team updraft all in one wp security & firewall +1 moreWordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability4.2 Medium
- envato template kit – importWordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability6.8 Medium
- cusrev customer reviews for woocommerceWordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability7.5 High
- hossni mubarak books galleryWordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability9.3 Critical
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability6.3 Medium
- awesomesupport awesome supportWordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- bobbingwide oikWordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- mra13 / team tips and tricks hq wp express checkout (accept paypal payments)WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability7.5 High
- makecommerce.net makecommerce for woocommerceWordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability8.2 High
- vendidero trusted shops easy integration for woocommerceWordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- appsbd viteposWordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability7.2 High
- wc product table woocommerce product table liteWordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- pixfort coreWordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability5.4 Medium
- unknown yith woocommerce ajax searchWordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- radiustheme classified listingWordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- estatikWordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability9.8 Critical
- siteskiteWordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- booklyWordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability7.5 High
- booklyWordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability7.6 High
- estatikWordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability7.6 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability7.2 High
- Show moreLoading…