UpHeron
All posts

Daily summary

Vulnerabilities of 28 October 2026: 82 new, 5 critical, 2 newly exploited

82 vulnerabilities added on 28 October 2026, 5 critical and 26 high: PHP object injection in WordPress plugins, Arbitrary file upload in WordPress plugins, Authentication bypass in WordPress plugins and more. 2 vulnerabilities newly listed as exploited by CISA.

  • 5 critical
  • 26 high
  • 49 medium
  • 1 low
  • 1 unrated
  • 2 newly exploited

Newly listed as exploited

Added to CISA's Known Exploited Vulnerabilities catalog: attackers use them.

  1. 9.3Magento / Adobe CommerceAdobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of…ExploitedUp to 2.4.9CVE-2026-48356
  2. 9.2BrotliNode.js Brotli decoder out-of-bounds write permits remote code executionExploitedFixed in 24.22.1, 26.12.1CVE-2026-111497

PHP object injection in WordPress plugins

6 vulnerabilities

  1. 9.8Ultimate MemberUp to 2.13.1CVE-2026-115968
  2. 8.8Phoenix Media RenameUp to 3.13.5CVE-2026-116389
  3. 8.8GS Logo SliderUp to 3.8.9CVE-2026-116391
  4. 7.2Filter Everything — WordPress & WooCommerce FiltersUp to 1.9.7CVE-2026-116390
  5. 7.2DokanUp to 5.3.1CVE-2026-115590
  6. 7.2AccordionUp to 2.3.25CVE-2026-116392

Arbitrary file upload in WordPress plugins

3 vulnerabilities

  1. 9.8Contact ManagerUnauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist BypassUp to 9.1.2CVE-2026-109218
  2. 8.8The Innovative Form BuilderAuthenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart UploadUp to 1.5.1CVE-2026-109384
  3. 7.5affiliate-toolkitAuthenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' ParameterUp to 3.9.2CVE-2026-111255

Authentication bypass in WordPress plugins

2 vulnerabilities

  1. 9.8Jupiter X CoreUnauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier ParameterUp to 4.61.0CVE-2026-106013
  2. 4.8Customer Email Verification for WooCommerceUnauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' ParameterUp to 2.8.2CVE-2026-109236

SQL injection in WordPress plugins

7 vulnerabilities

  1. 9.3FunnelKit AutomationsUp to 3.8.5.2CVE-2026-111411
  2. 9.3DXP ToolKitUp to 2.0.1CVE-2026-115607
  3. 8.5Advanced Ads – TrackingFixed in 4.0.0CVE-2026-115603
  4. 8.5BuddyPressUp to 14.5.2CVE-2026-111850
  5. 6.5WP Inventory ManagerAuthenticated (Contributor+) SQL Injection via 'sort_order' Shortcode AttributeUp to 2.5.5CVE-2026-76005
Show 2 more
  1. 6.5VikRentCar Car Rental Management SystemAuthenticated (Contributor+) SQL Injection via 'catid' Block AttributeUp to 1.4.10CVE-2026-116750
  2. 6.5WP Visitor Statistics (Real Time Traffic)Authenticated (Contributor+) SQL Injection via 'from' Shortcode AttributeUp to 8.8CVE-2026-116609

Remote code execution in WordPress plugins

2 vulnerabilities

  1. 8.8VikRentCar Car Rental Management SystemCross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX TaskUp to 1.4.8CVE-2026-111120
  2. 8.8SEO By Rank MathVulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO RankingsFixed in 1.0.277CVE-2026-1928

Broken access control in WordPress plugins

15 vulnerabilities

  1. 7.5Optima Express + MarketBoost IDXUp to 9.0.0CVE-2026-116393
  2. 7.5Animated Text BlockMissing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode AttributeUp to 1.2.6CVE-2026-116613
  3. 6.9Disable Payment Method For WoocommerceMissing Authorization via update_feesFixed in 1.1.10.9CVE-2026-118757
  4. 6.5Redux FrameworkUp to 4.5.16CVE-2026-116404
  5. 6.5Rich Showcase for Google ReviewsMissing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin PageUp to 7.1.6CVE-2026-110020
Show 10 more
  1. 5.4My auctions allegroUp to 4.0.3CVE-2026-116855
  2. 5.3Advanced Custom Fields: ExtendedMissing Authorization to Unauthenticated Data Exposure via Multiple AJAX EndpointsUp to 0.9.2.7CVE-2026-2839
  3. 5.3PayPal Brasil para WooCommerceMissing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' ActionUp to 1.7.8CVE-2026-76058
  4. 5.1Ninja FormsServer-Side Validation Bypass via List FieldsFixed in 3.15.4CVE-2026-67187
  5. 4.3Enable Media ReplaceMissing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement WorkflowUp to 4.2.2CVE-2026-85655
  6. 4.3TravellyMissing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' ParameterUp to 2.3.6CVE-2026-111213
  7. 4.3Clean LoginMissing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' HookUp to 1.20.1CVE-2026-116610
  8. 4.3Related Posts for WordPressMissing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' ParameterUp to 3.0.0CVE-2026-109980
  9. 4.3Related Posts for WordPressMissing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' ParameterUp to 3.0.0CVE-2026-109979
  10. 4.3AI ChatBot for WooCommerceMissing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX ActionUp to 5.0.0CVE-2026-111372

Arbitrary file access in WordPress plugins

2 vulnerabilities

  1. 7.5Product Designer for WooCommerce WordPress | LumiseUnauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON UploadUp to 2.1.2CVE-2026-15323
  2. 4.2AI EngineAuthenticated (Subscriber+) Limited Media File Deletion via 'metadata' ParameterUp to 3.8.4CVE-2026-107745

Cross-site scripting in WordPress plugins

38 vulnerabilities

  1. 7.2Prime SliderUnauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-EscapeUp to 4.7.2CVE-2026-111111
  2. 7.2MxChatUnauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_ratingUp to 3.2.25CVE-2026-110662
  3. 7.2affiliate-toolkitUnauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' ParameterUp to 3.9.2CVE-2026-111314
  4. 7.2AI Marketing ExpertUnauthenticated Stored DOM-Based Cross-Site Scripting via 'name' ParameterUp to 1.2.8CVE-2026-109999
  5. 7.2AMP for WPUnauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode AttributeUp to 1.1.17CVE-2026-97019
Show 33 more
  1. 7.1SliceWPUp to 1.2.13CVE-2026-115612
  2. 7.1Unlimited Elements For ElementorUp to 2.0.24CVE-2026-115593
  3. 7.1eCommerce Product CatalogUp to 3.6.4CVE-2026-115596
  4. 7.1DXP ToolKitUp to 2.0.1CVE-2026-115606
  5. 7.1GetPaidUp to 2.8.62CVE-2026-115609
  6. 6.5WP Discussion BoardUp to 2.6.0CVE-2026-115957
  7. 6.4Cozy BlocksAuthenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block AttributeUp to 2.2.27CVE-2026-109975
  8. 6.4Document EmbedderAuthenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block AttributeUp to 2.4.0CVE-2026-109370
  9. 6.4HustleAuthenticated (Contributor+) Stored Cross-Site Scripting via Module Content TitleUp to 7.8.14.3CVE-2026-107710
  10. 6.4Post SnippetsAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesUp to 4.2.4CVE-2026-77871
  11. 6.4easy.jobsAuthenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block AttributeUp to 2.8.2CVE-2026-108366
  12. 6.4Mang BoardAuthenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode AttributeUp to 2.4.5CVE-2026-110071
  13. 6.4VikRentCar Car Rental Management SystemAuthenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block AttributeUp to 1.4.10CVE-2026-116749
  14. 6.4If-So Dynamic ContentAuthenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' ParameterUp to 1.10.2CVE-2026-118164
  15. 6.4Waitlist Woocommerce ( Back in stock notifier )Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode AttributeUp to 2.9.1CVE-2026-77188
  16. 6.4If-So Dynamic ContentAuthenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode AttributeUp to 1.10.2CVE-2026-104740
  17. 6.4Cozy BlocksAuthenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block AttributeUp to 2.2.27CVE-2026-109978
  18. 6.4s2MemberAuthenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode AttributeUp to 261011CVE-2026-109972
  19. 6.4UiChemyAuthenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URLUp to 5.3.0CVE-2026-109385
  20. 6.4TravellyAuthenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode AttributesUp to 2.3.6CVE-2026-109590
  21. 6.4If-So Dynamic ContentAuthenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' AttributeUp to 1.10.2CVE-2026-103996
  22. 6.4Awesome SupportAuthenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME ConfusionUp to 6.4.1CVE-2026-103370
  23. 6.4Appointment Booking CalendarAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' ParameterUp to 1.4.05CVE-2026-111727
  24. 6.4All-in-One Video GalleryAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPCUp to 4.9.7CVE-2026-109209
  25. 6.4Ultimate MemberAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile FieldUp to 2.14.0CVE-2026-107625
  26. 6.4All-in-One Video GalleryAuthenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode AttributeUp to 4.9.7CVE-2026-109974
  27. 6.1Echo Knowledge BaseReflected Cross-Site Scripting via 'new_kb_config' ParameterUp to 17.214.0CVE-2026-101935
  28. 6.1Webheadcoder Multi-Step Forms for Contact Form 7Reflected Cross-Site Scripting via 'l10n_print_after' ParameterUp to 4.7CVE-2026-92098
  29. 5.4CMB2Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End FormUp to 2.13.4CVE-2026-116761
  30. 5.4PostieUnauthenticated Stored Cross-Site Scripting via Email Body URL AutolinkUp to 1.9.87CVE-2026-100175
  31. 4.9HustleAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' ParameterUp to 7.8.14.3CVE-2026-118169
  32. 4.4Product Addons for WoocommerceAuthenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field ParameterUp to 3.1.8CVE-2026-109988
  33. 4.4DesignSetGoAuthenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block AttributeUp to 2.11.0CVE-2026-111068

Privilege escalation in WordPress plugins

2 vulnerabilities

  1. 7.2Event Booking Manager for WooCommerceAuthenticated (Shop Manager+) Privilege Escalation to 'page' ParameterUp to 5.7.8CVE-2026-109381
  2. 6.3BeyondSEOMissing Authorization to Authenticated (Contributor+) Limited Privilege EscalationUp to 1.3.6CVE-2026-76780

Other vulnerabilities in WordPress plugins

3 vulnerabilities

  1. 7.5Contact Form by SupsysticSensitive Data ExposureUp to 1.10.5CVE-2026-115591
  2. 5.9Bit PiUnauthenticated Local File Inclusion via 'webhook' and 'body' ParametersUp to 1.31.0CVE-2026-110185
  3. 4.9TainacanAuthenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass AssignmentUp to 1.3.0CVE-2026-104743

Elixir and Erlang packages

1 vulnerability

  1. –banditHTTP/2 request bodies made of 1-byte DATA frames amplify memory use in BanditFixed in 1.14.1CVE-2026-116078

Go modules

1 vulnerability

  1. LowCaddyCaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughFixed in 2.11.5CVE-2026-55458

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.