CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter6.4 Medium
- melograno the innovative form builder – ivyformsThe Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload8.8 High
- wayne allen postiePostie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink5.4 Medium
- xootix waitlist woocommerce ( back in stock notifier )Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute6.4 Medium
- richplugins rich showcase for google reviewsRich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page6.5 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task8.8 High
- barrykooij related posts for wordpressRelated Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter4.3 Medium
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute6.4 Medium
- quantumcloud ai chatbot for woocommerce – woowbotAI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action4.3 Medium
- cozythemes cozy blocks – website builder & business growth toolkit | popups, lead forms & inboxCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute6.4 Medium
- odefranca paypal brasil para woocommerce, paypal brasil para woocommerce +1 morePayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action5.3 Medium
- justin nealey designsetgoDesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute4.4 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute6.4 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes6.4 Medium
- posimyththemes uichemy – convert figma, prompts and ai builds to elementor, gutenberg and bricksUiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL6.4 Medium
- mxchat – ai chatbot & content generation for wordpressMxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating7.2 High
- ifso if-so dynamic content – elementor & all page builders personalizationIf-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute6.4 Medium
- magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendarEvent Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter7.2 High
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion6.4 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute6.5 Medium
- unknown recipe card blocks liteRecipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute6.8 Medium
- unknown wp rosterWP Roster < 2.35 - Unauthenticated Roster Member Deletion5.3 Medium
- unknown customer engagement systemSmart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup5.8 Medium
- unknown customer engagement systemSmart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding4.1 Medium
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure6.5 Medium
- paolo geodirectoryGeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode2.7 Low
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute6.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute6.8 Medium
- david lingren media library assistantMedia Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF6.5 Medium
- david lingren media library assistantMedia Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF6.5 Medium
- unknown mp3 audio playerMP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute6.8 Medium
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page3.8 Low
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability4.3 Medium
- unknown gosmtpGoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings7.2 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax3.8 Low
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter4.7 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter6.8 Medium
- unknown افزونه پیامک ووکامرس | persian woocommerce smsPersian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter7.1 High
- unknown wporloginWPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update6.5 Medium
- unknown copy anything to clipboard for wordpressCopy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute6.8 Medium
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler5.3 Medium
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments2.7 Low
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class6.8 Medium
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent6.5 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content5.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting6.8 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe5.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision3.8 Low
- unknown court reservationCourt Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion5.3 Medium
- unknown court reservationCourt Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion5.3 Medium
- Show moreLoading…