Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

15,012 results · Feed

  • High 7.1
    CVE-2026-97271

    WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

    WPFunnels WPFunnels
  • High 7.1
    CVE-2026-97272

    WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

    Premmerce Premmerce Permalink Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-97270

    WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

    Justin Sternberg CMB2
  • Medium 4.3
    CVE-2026-97267

    WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

    miniOrange Prevent files / folders access
  • Medium 6.5
    CVE-2026-97262

    WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

    Visual Composer Visual Composer Website Builder
  • Medium 6.5
    CVE-2026-97266

    WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

    Nexcess Virtue/Ascend/Pinnacle Toolkit
  • Medium 5.3
    CVE-2026-97261

    WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

    villatheme Notivo
  • High 7.1
    CVE-2026-97253

    WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

    Kreatura LayerSlider
  • High 7.1
    CVE-2026-97250

    WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

    Dylan Kuhn Geo Mashup
  • Medium 5.3
    CVE-2026-97249

    WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

    Cozmoslabs Paid Member Subscriptions
  • Critical 9.8
    CVE-2026-97248

    WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

    Booking Activities Team Booking Activities
  • Medium 6.5
    CVE-2026-97247

    WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

    Creative Themes Blocksy Companion
  • Medium 4.9
    CVE-2026-97246

    WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

    ShortPixel ShortPixel Image Optimizer
  • High 7.2
    CVE-2026-97245

    WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

    Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

    surecart SureCart
  • High 7.5
    CVE-2026-97244

    WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

    Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

    WPFunnels Creator LMS
  • Medium 5.4
    CVE-2026-97243

    WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

    flexyma AllAble Connector
  • Medium 6.8
    CVE-2026-97242

    WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

    Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

    phuongwebo WEBO MCP
  • High 7.5
    CVE-2026-97240

    WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

    Esteban StifLi Backup Tools
  • High 7.5
    CVE-2026-97241

    WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

    PrecisionWP BackupEase
  • Medium 6.5
    CVE-2026-97239

    WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

    Jose Conti MCP Content Manager Lite
  • Medium 5.5
    CVE-2026-97238

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

    Crocoblock. Jetimpex JetEngine
  • High 7.1
    CVE-2026-97237

    WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2026-97236

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • High 7.1
    CVE-2026-97235

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • High 7.5
    CVE-2026-97197

    WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

    WebToffee WordPress Backup & Migration Web / CMS
  • Medium 4.3
    CVE-2026-97079

    WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.

    Webba Appointment Booking Webba Booking
  • Medium 5.3
    CVE-2026-97078

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.

    Bold Grid Client Invoicing by Sprout Invoices
  • High 7.1
    CVE-2026-97077

    WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

    spacetime Ad Inserter
  • Medium 4.3
    CVE-2026-97074

    WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

    Omnisend Newsletters, Email Marketing, SMS and Popups by Omnisend
  • Medium 6.5
    CVE-2026-97067

    WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.

    Shane Bishop EWWW Image Optimizer
  • Medium 5.3
    CVE-2026-97066

    WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.

    Nexcess GiveWP
  • High 7.1
    CVE-2026-97065

    WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

    Happyforms Happyforms
  • High 8.8
    CVE-2026-96838 Public exploit

    WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

    YoOhw Studio Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification Web / CMS
  • High 8.8
    CVE-2026-96837

    WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability

    Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

    Brainstorm Force CartFlows
  • High 7.1
    CVE-2026-96836

    WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

    Morteza Geransayeh Parsi Date
  • Medium 6.5
    CVE-2026-96835

    WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

    KingAddons.com King Addons for Elementor
  • Medium 6.5
    CVE-2026-96834

    WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9.

    Liquid Web / StellarWP GiveWP
  • High 7.2
    CVE-2026-96833

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 7.2
    CVE-2026-96832

    WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

    keywordrush Content Egg
  • High 8.8
    CVE-2026-96831

    WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

    themifyme Themify Builder