Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

5,174 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-97288

    WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

    Jayson T Cote OAuth Server
  • Medium 6.5
    CVE-2026-97286 Public exploit

    WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

    WP Chill Strong Testimonials
  • Medium 5.3
    CVE-2026-97282

    WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

    RadiusTheme Review Schema
  • Medium 5.4
    CVE-2026-97285

    WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

    Nexcess The Events Calendar
  • Medium 6.5
    CVE-2026-97279

    WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

    Chouby Polylang
  • Medium 6.5
    CVE-2026-97270

    WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

    Justin Sternberg CMB2
  • Medium 4.3
    CVE-2026-97267

    WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

    miniOrange Prevent files / folders access
  • Medium 6.5
    CVE-2026-97262

    WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

    Visual Composer Visual Composer Website Builder
  • Medium 6.5
    CVE-2026-97266

    WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

    Nexcess Virtue/Ascend/Pinnacle Toolkit
  • Medium 5.3
    CVE-2026-97261

    WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

    villatheme Notivo
  • Medium 5.3
    CVE-2026-97249

    WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

    Cozmoslabs Paid Member Subscriptions
  • Medium 6.5
    CVE-2026-97247

    WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

    Creative Themes Blocksy Companion
  • Medium 4.9
    CVE-2026-97246

    WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

    ShortPixel ShortPixel Image Optimizer
  • Medium 5.4
    CVE-2026-97243

    WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

    flexyma AllAble Connector
  • Medium 6.8
    CVE-2026-97242

    WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

    Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

    phuongwebo WEBO MCP
  • Medium 6.5
    CVE-2026-97239

    WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

    Jose Conti MCP Content Manager Lite
  • Medium 5.5
    CVE-2026-97238

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

    Crocoblock. Jetimpex JetEngine
  • Medium 6.5
    CVE-2026-97236

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Medium 4.3
    CVE-2026-97079

    WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

    Webba Appointment Booking Webba Booking
  • Medium 5.3
    CVE-2026-97078

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

    Bold Grid Client Invoicing by Sprout Invoices
  • Medium 4.3
    CVE-2026-97074

    WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

    Omnisend Newsletters, Email Marketing, SMS and Popups by Omnisend
  • Medium 6.5
    CVE-2026-97067

    WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

    Shane Bishop EWWW Image Optimizer
  • Medium 5.3
    CVE-2026-97066

    WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

    Nexcess GiveWP
  • Medium 6.5
    CVE-2026-96835

    WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

    KingAddons.com King Addons for Elementor
  • Medium 6.5
    CVE-2026-96834

    WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9.

    Liquid Web / StellarWP GiveWP
  • Medium 6.5
    CVE-2026-96829

    WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 4.2
    CVE-2026-96825

    WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability

    Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

    David Anderson / Team Updraft All In One WP Security & Firewall
  • Medium 6.8
    CVE-2026-96824

    WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

    Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

    envato Template Kit – Import
  • Medium 6.3
    CVE-2026-96821

    WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

    Mahmudul Hasan Arif FluentBoards
  • Medium 5.4
    CVE-2026-96450

    WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

    pixfort pixfort Core
  • Medium 6.5
    CVE-2026-96347

    WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

    Bookly Bookly
  • Medium 6.5
    CVE-2026-96338

    WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

    Cozmoslabs Profile Builder
  • Medium 5.9
    CVE-2026-94681

    WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

    Tijmen Smit WP Store Locator
  • Medium 6.5
    CVE-2026-94674

    WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

    SweetCode Pixel Manager for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-94673

    WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

    N Squared Simply Schedule Appointments
  • Medium 4.3
    CVE-2026-94672

    WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

    10up Safe SVG
  • Medium 5.4
    CVE-2026-94173

    WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

    Strategy11 Team Business Directory
  • Medium 6.5
    CVE-2026-94077

    WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

    10up Safe SVG
  • Medium 6.5
    CVE-2026-94074 Public exploit

    WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

    N Squared Simply Schedule Appointments
  • Medium 5.4
    CVE-2026-62081

    WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

    Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

    WP Desk Flexible PDF Coupons