Content injection in WordPress plugins

Content injection lets an attacker add text, HTML or links to your pages without being able to run scripts. Typical results are spam links, fake notices or phishing text that appears to come from your site.

It is usually rated lower than XSS, but spam content can still get your site flagged by search engines or used in phishing.

What to do: update the plugin, then search your posts and pages for content you did not add.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Content injection records

39 on record for the plugins we track. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

high 8.8 Formidable Forms

Content injection

CVE-2026-89435 · affected 6.35 and older · fixed in 7.0 * · published 2026-10-30
medium 4.8 Advanced Custom Fields

Content injection

CVE-2026-94263 · affected 0.9.2.4 up to (not including) 0.9.2.8 · fixed in 0.9.2.8 · published 2026-10-23
medium 5.4 Responsive Blocks

Content injection

CVE-2026-97315 · affected older than 2.3.0 · fixed in 2.3.0 · published 2026-10-14
medium 5.4 Kirki

Content injection

CVE-2026-102291 · affected 6.3.1 and older · fixed in 6.3.2 * · published 2026-10-10
medium 4.8 Kirki

Content injection

CVE-2026-84220 · affected older than 6.3.2 · fixed in 6.3.2 · published 2026-10-09
medium 5.4 MetForm

Content injection

CVE-2026-86833 · affected older than 4.3.1 · fixed in 4.3.1 · published 2026-10-07
medium 6.5 All in One SEO

Content injection

CVE-2026-19856 · affected older than 5.0.2.1 · fixed in 5.0.2.1 · published 2026-10-02
medium 6.5 The Events Calendar

Content injection

CVE-2026-84740 · affected 6.12.0 up to (not including) 6.17.5.1 · fixed in 6.17.5.1 · published 2026-10-02
medium 5.4 Unlimited Elements for Elementor

Content injection

CVE-2026-92924 · affected older than 2.0.21 · fixed in 2.0.21 · published 2026-10-02
medium 5.6 Ninja Tables

Content injection

CVE-2026-86612 · affected older than 5.2.17 · fixed in 5.2.17 · published 2026-09-23
medium 6.5 WP Recipe Maker

Content injection

CVE-2026-86601 · affected older than 10.8.2 · fixed in 10.8.2 · published 2026-09-23
medium 4.6 MasterStudy LMS WordPress Plugin

Content injection

CVE-2026-81338 · affected older than 3.7.50 · fixed in 3.7.50 · published 2026-09-23
medium 4.8 Formidable Forms

Content injection

CVE-2026-19857 · affected 6.34 up to (not including) 6.35 · fixed in 6.35 · published 2026-09-16
medium 6.5 Simple CAPTCHA with Cloudflare Turnstile

Content injection

CVE-2026-85116 · affected 1.2.2 up to (not including) 1.42.3 · fixed in 1.42.3 · published 2026-09-11
medium 6.5 Simple CAPTCHA with Cloudflare Turnstile

Content injection

CVE-2026-66632 · affected 1.42.1 and older · fixed in 1.42.3 · published 2026-09-10
medium 4.8 Ninja Forms

Content injection

CVE-2026-80437 · affected 3.14.10 up to (not including) 3.15.2 · fixed in 3.15.2 · published 2026-09-06
medium 4.8 Redirection for Contact Form 7

Content injection

CVE-2026-80439 · affected 2.2.7 up to (not including) 3.2.11 · fixed in 3.2.11 · published 2026-09-06
medium 6.5 JetFormBuilder

Content injection

CVE-2026-19859 · affected older than 3.6.5.2 · fixed in 3.6.5.2 · published 2026-09-06
medium 4.8 MW WP Form

Content injection

CVE-2026-78363 · affected older than 5.1.5 · fixed in 5.1.5 · published 2026-09-01
critical 9.8 Tutor LMS

Content injection

CVE-2026-19092 · affected 2.1.3 up to (not including) 4.0.6 · fixed in 4.0.6 · published 2026-08-27
medium 5.3 Product Table & List Builder for WooCommerce

Content injection

CVE-2026-15441 · affected 5.6.0 and older · fixed in 5.6.5 * · published 2026-08-16
medium 6.5 Kirki

Content injection

CVE-2026-16747 · affected older than 6.2.1 · fixed in 6.2.1 · published 2026-08-12
medium 4.8 Ninja Forms

Content injection

CVE-2026-15256 · affected older than 3.14.10 · fixed in 3.14.10 · published 2026-08-06
medium 5.3 TI WooCommerce Wishlist

Content injection

CVE-2025-9207 · affected 2.10.0 and older · fixed in 2.11.0 * · published 2025-12-13
medium 4.3 Calculated Fields Form

Content injection

CVE-2024-9940 · affected 5.2.45 and older · fixed in 5.2.46 * · published 2024-10-17
medium 6.1 WooCommerce

Content injection

CVE-2024-9944 · affected 9.0.2 and older · fixed in 9.0.3 * · published 2024-10-15
medium 6.1 Comments

Content injection

CVE-2024-6704 · affected 7.6.21 and older · fixed in 7.6.22 * · published 2024-08-02
medium 5.4 Cooked

Content injection

CVE-2024-39682 · affected 1.7.15.4 and older · fixed in 1.8.0 * · published 2024-07-18
low 3.5 WooCommerce

Content injection

CVE-2024-35777 · affected 8.9.2 and older · fixed in 9.0.0 · published 2024-07-09
medium 5.3 PPOM

Content injection

CVE-2024-35728 · affected 32.0.20 and older · fixed in 32.0.21 · published 2024-06-10
medium 5.3 Spectra Legacy

Content injection

CVE-2023-23738 · affected 2.3.0 and older · fixed in 2.3.1 · published 2024-06-03
medium 5.4 Ultimate Addons for Elementor

Content injection

CVE-2024-2619 · affected 1.6.26 and older · fixed in 1.6.27 * · published 2024-05-16
medium 6.1 Formidable Forms

Content injection

CVE-2023-6830 · affected 6.7 and older · fixed in 6.7.1 * · published 2024-01-09
medium 4.8 MainWP Dashboard

Content injection

CVE-2023-6164 · affected 4.5.1.2 and older · fixed in 4.5.1.3 * · published 2023-11-22
medium 5.3 Frontend File Manager Plugin

Content injection

CVE-2021-4369 · affected older than 18.3 · fixed in 18.3 · published 2023-06-07
medium 5.3 Frontend File Manager Plugin

Content injection

CVE-2021-4350 · affected older than 18.3 · fixed in 18.3 · published 2023-06-07
high 7.5 Redirection for Contact Form 7

Content injection

CVE-2021-36913 · affected 2.4.0 and older · fixed in 2.6.0 * · published 2022-10-11
medium 4.8 WooCommerce

Content injection

CVE-2022-2099 · affected older than 6.6.0 · fixed in 6.6.0 · published 2022-07-17
medium 6.1 Ultimate FAQ Accordion Plugin

Content injection

CVE-2019-17233 · affected 1.8.24 and older · fixed in 1.8.25 * · published 2019-10-07

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan