Remote code execution in WordPress plugins

Remote code execution means an attacker can make your server run code of their choosing. This includes code injection in PHP and command injection, where input ends up in a shell command. It is the worst outcome a plugin bug can have: whoever exploits it controls the site and often everything else in the same hosting account.

Attackers scan for these within days of disclosure. A record that needs no login and has a critical score should be treated as urgent.

What to do: update immediately, or deactivate and delete the plugin if no fix exists. If the site ran a vulnerable version, assume it may have been compromised: look for new admin users, unfamiliar PHP files in wp-content/uploads, and changed core files, or run a free scan.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest Remote code execution records

391 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

critical 9.8 s2Member

Remote code execution

CVE-2026-86596 · affected 260927 and older · fixed in 261001 * · published 2026-11-02
high 8.8 Photo Gallery, Sliders, Proofing and Themes

Remote code execution

CVE-2026-76010 · affected 4.4.1 and older · fixed in 4.5.0 * · published 2026-10-31
critical 9.8 Project Manager

Remote code execution

CVE-2026-116512 · affected 4.1.1 and older · fixed in 4.1.2 * · published 2026-10-31
high 8.1 WordPress

Remote code execution

CVE-2026-119977 · affected 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, 5.4.0 to 5.4.24, 5.5.0 to 5.5.23, 5.6.0 to 5.6.22, 5.7.0 to 5.7.20, 5.8.0 to 5.8.18, 5.9.0 to 5.9.19, 6.0.0 to 6.0.17, 6.1.0 to 6.1.15, 6.2.0 to 6.2.14, 6.3.0 to 6.3.13, 6.4.0 to 6.4.13, 6.5.0 to 6.5.13, 6.6.0 to 6.6.10, 6.7.0 to 6.7.10, 6.8.0 to 6.8.11, 6.9.0 to 6.9.10, 7.0.0 to 7.0.7, 7.1.0 to 7.1.3 · fix not stated · published 2026-10-31
medium 5.4 Ninja Forms

Remote code execution

CVE-2026-101326 · affected 3.15.5 and older · fixed in 3.15.6 * · published 2026-10-31
medium 6.5 Ninja Forms

Remote code execution

CVE-2026-100155 · affected 3.15.5 and older · fixed in 3.15.6 * · published 2026-10-31
critical 9.1 Widget Options

Remote code execution

CVE-2026-116852 · affected 4.2.5 and older · fixed in 4.2.6 · published 2026-10-30
medium 6.5 GeoDirectory

Remote code execution

CVE-2026-118635 · affected 2.8.198 and older · fixed in 2.8.199 * · published 2026-10-30
medium 6.5 Ad Inserter

Remote code execution

CVE-2026-102905 · affected 2.8.19 and older · fixed in 2.8.20 * · published 2026-10-30
high 7.2 Contact Form by Supsystic

Remote code execution

CVE-2026-115301 · affected older than 1.11.1 · fixed in 1.11.1 · published 2026-10-29
critical 9.8 Checkout Files Upload for WooCommerce

Remote code execution

CVE-2026-103688 · affected older than 2.4.0 · fixed in 2.4.0 · published 2026-10-28
high 7.2 GeoDirectory

Remote code execution

CVE-2026-113673 · affected older than 2.8.194 · fixed in 2.8.194 · published 2026-10-24
critical 9.0 Advanced Custom Fields

Remote code execution

CVE-2026-94267 · affected older than 0.9.2.8 · fixed in 0.9.2.8 · published 2026-10-23
high 7.6 Royal Addons for Elementor

Remote code execution

CVE-2026-111851 · affected 1.7.1068 and older · fixed in 1.7.1069 · published 2026-10-22
medium 4.8 WP Ultimate Review

Remote code execution

CVE-2026-103234 · affected older than 2.4.5 · fixed in 2.4.5 · published 2026-10-22
critical 9.9 HivePress

Remote code execution

CVE-2026-110887 · affected 1.7.32 and older · fixed in 1.8.0 · published 2026-10-19
medium 6.5 HivePress

Remote code execution

CVE-2026-110885 · affected 1.7.32 and older · fixed in 1.8.0 · published 2026-10-18
medium 6.6 ACF Frontend Admin by DynamiApps

Remote code execution

CVE-2026-81344 · affected 3.29.13 and older · fixed in 3.30.0 * · published 2026-10-17
high 8.1 User Registration & Membership

Remote code execution

CVE-2026-92798 · affected 5.2.8 and older · fixed in 5.3.0 * · published 2026-10-17
medium 5.4 ProfilePress

Remote code execution

CVE-2026-104003 · affected 4.17.5 and older · fixed in 4.17.6 * · published 2026-10-16
high 8.8 WP Photo Album Plus

Remote code execution

CVE-2026-92115 · affected 9.3.02.002 and older · fixed in 9.3.02.003 * · published 2026-10-16
medium 5.4 User Registration & Membership

Remote code execution

CVE-2026-15222 · affected 5.2.8 and older · fixed in 5.3.0 * · published 2026-10-16
medium 5.3 Lightweight Cookie Notice

Remote code execution

CVE-2026-12272 · affected 1.19 and older · fixed in 1.20 * · published 2026-10-16
medium 5.4 Slim SEO

Remote code execution

CVE-2026-104001 · affected 4.11.1 and older · fixed in 4.11.2 * · published 2026-10-16
medium 6.5 Broken Link Checker

Remote code execution

CVE-2026-96562 · affected 2.4.14.1 and older · fixed in 2.4.15 * · published 2026-10-16
medium 6.5 Forminator Forms

Remote code execution

CVE-2026-103911 · affected 1.58.1 and older · fixed in 1.58.2 * · published 2026-10-16
medium 4.8 Popup Box

Remote code execution

CVE-2026-100159 · affected 6.4.1 to 6.4.2 · fixed in 6.4.3 * · published 2026-10-16
medium 6.5 Broken Link Checker

Remote code execution

CVE-2026-102389 · affected 2.4.14.1 and older · fixed in 2.4.15 · published 2026-10-15
medium 6.5 Ocean Extra

Remote code execution

CVE-2026-86803 · affected 2.6.0 and older · fixed in 2.6.1 * · published 2026-10-15
medium 5.3 MDTF

Remote code execution

CVE-2026-108151 · affected 1.3.9 and older · fixed in 1.4.0 · published 2026-10-14
high 7.5 Salevo Boost Sales for WooCommerce

Remote code execution

CVE-2026-103081 · affected 1.3.0 and older · fixed in 1.3.1 · published 2026-10-14
high 7.5 Mailonix

Remote code execution

CVE-2026-103358 · affected 1.3.4 and older · fixed in 1.3.5 · published 2026-10-14
high 7.2 affiliate-toolkit

Remote code execution

CVE-2026-86787 · affected 3.8.7 up to (not including) 3.9.1 · fixed in 3.9.1 · published 2026-10-14
critical 9.8 AGE-GATE

Remote code execution

CVE-2026-104800 · affected 1.0 and older · fix not stated · published 2026-10-14
critical 9.1 Click to Chat

Remote code execution

CVE-2026-92097 · affected 4.44 and older · fixed in 4.45 * · published 2026-10-14
high 8.1 BP Profile Search

Remote code execution

CVE-2026-104995 · affected 5.9 and older · fixed in 6.0 * · published 2026-10-14
critical 10.0 SiteVault

Remote code execution

CVE-2026-42696 · affected 1.5.19 and older · fixed in 1.5.20 · published 2026-10-10
high 8.1 Everest Backup

Remote code execution

CVE-2026-39802 · affected 2.3.13 and older · fixed in 2.3.14 * · published 2026-10-10
high 7.5 Thanko Thank You Page Customizer for WooCommerce

Remote code execution

CVE-2026-103071 · affected 1.2.3 and older · fixed in 1.2.4 · published 2026-10-10
high 7.2 Rank Math SEO

Remote code execution

CVE-2026-104752 · affected older than 1.0.280 · fixed in 1.0.280 · published 2026-10-10
critical 9.8 3D Product configurator for WooCommerce

Remote code execution

CVE-2026-103889 · affected 2.16.2 and older · fixed in 2.16.3 * · published 2026-10-10
high 7.2 Fastcache by Host.it

Remote code execution

CVE-2026-104021 · affected 1.7.4 and older · fixed in 1.7.5 * · published 2026-10-10
high 8.8 AWP Classifieds

Remote code execution

CVE-2025-15700 · affected older than 4.4.9 · fixed in 4.4.9 · published 2026-10-09
medium 6.6 BackWPup

Remote code execution

CVE-2026-86828 · affected older than 5.7.7 · fixed in 5.7.7 · published 2026-10-08
high 8.0 Tabs Responsive

Remote code execution

CVE-2026-39776 · affected 2.5 and older · fix not stated · published 2026-10-06
critical 9.1 Beaver Builder Page Builder

Remote code execution

CVE-2026-92084 · affected 2.11.0.5 and older · fixed in 2.11.0.6 * · published 2026-10-03
medium 5.4 WP Ultimate Review

Remote code execution

CVE-2026-103519 · affected 2.4.3 and older · fixed in 2.4.4 * · published 2026-10-03
medium 6.5 WP Ultimate Review

Remote code execution

CVE-2026-100157 · affected 2.4.3 and older · fixed in 2.4.4 * · published 2026-10-03
medium 6.6 Unlimited Elements for Elementor

Remote code execution

CVE-2026-85015 · affected older than 2.0.21 · fixed in 2.0.21 · published 2026-10-03
medium 6.5 All in One SEO

Remote code execution

CVE-2026-100152 · affected 5.0.2 and older · fixed in 5.0.2.1 * · published 2026-10-03
critical 9.1 Appointment Booking Plugin

Remote code execution

CVE-2026-92966 · affected 5.7.0 and older · fixed in 5.7.1 * · published 2026-10-01
high 8.8 CartFlows

Remote code execution

CVE-2026-96837 · affected 3.2.0 and older · fixed in 3.2.1 · published 2026-09-30
critical 10.0 SiteSkite

Remote code execution

CVE-2026-96349 · affected 2.1.8 and older · fixed in 2.2.0 · published 2026-09-30
critical 9.0 AcyMailing

Remote code execution

CVE-2026-94389 · affected 11.0.5 and older · fixed in 11.1.0 · published 2026-09-30
high 7.5 Ad Inserter

Remote code execution

CVE-2026-81655 · affected 2.8.12 up to (not including) 2.8.19 · fixed in 2.8.19 · published 2026-09-27
high 8.8 s2Member

Remote code execution

CVE-2026-19804 · affected 260814 and older · fixed in 260829 * · published 2026-09-25
medium 4.9 Product Feed Manager for WooCommerce

Remote code execution

CVE-2026-15095 · affected 6.6.43 and older · fixed in 6.6.44 * · published 2026-09-22
high 8.1 WP Ultimate Review

Remote code execution

CVE-2026-92235 · affected 2.4.2 and older · fixed in 2.4.3 * · published 2026-09-22
high 8.5 Forminator Forms

Remote code execution

CVE-2026-87067 · affected 1.57.0.7 up to (not including) 1.57.2.1 · fixed in 1.57.2.1 · published 2026-09-20
high 7.2 Photo Gallery, Sliders, Proofing and Themes

Remote code execution

CVE-2026-81650 · affected older than 4.5.0 · fixed in 4.5.0 · published 2026-09-20
high 8.1 ProfilePress

Remote code execution

CVE-2026-85658 · affected 4.17.2 and older · fixed in 4.17.3 * · published 2026-09-19
high 8.8 The Welcomizer

Remote code execution

CVE-2026-4327 · affected 2.8.1 and older · fixed in 999.0 * · published 2026-09-19
critical 9.1 Forminator Forms

Remote code execution

CVE-2026-92229 · affected 1.57.2 and older · fixed in 1.57.2.1 * · published 2026-09-19
high 8.8 Save as PDF Plugin by PDFCrowd

Remote code execution

CVE-2026-92807 · affected 4.6.1 and older · fixed in 4.6.2 * · published 2026-09-19
critical 9.1 WP Recipe Maker

Remote code execution

CVE-2026-89274 · affected 10.8.1 and older · fixed in 10.8.2 * · published 2026-09-19
high 7.5 WP Photo Album Plus

Remote code execution

CVE-2026-87909 · affected 9.2.09.002 and older · fixed in 9.2.10.001 * · published 2026-09-19
critical 10.0 Migratico Lite

Remote code execution

CVE-2026-62104 · affected 2.6.8 and older · fixed in 2.7.1 · published 2026-09-17
high 8.8 WP Import Export Lite

Remote code execution

CVE-2026-76552 · affected older than 3.9.33 · fixed in 3.9.33 · published 2026-09-16
high 7.2 WP Import Export Lite

Remote code execution

CVE-2026-76551 · affected older than 3.9.33 · fixed in 3.9.33 · published 2026-09-16
high 7.2 WP Import Export Lite

Remote code execution

CVE-2026-76550 · affected older than 3.9.34 · fixed in 3.9.34 · published 2026-09-16
high 8.8 Contest Gallery

Remote code execution

CVE-2026-78088 · affected 32.0.1 and older · fixed in 33.0.2 * · published 2026-09-16
high 7.5 Eventin

Remote code execution

CVE-2026-75983 · affected 4.1.23 and older · fixed in 4.1.24 * · published 2026-09-15
high 7.5 GEO my WP

Remote code execution

CVE-2026-85200 · affected 4.5.5.3 and older · fixed in 4.5.5.4 * · published 2026-09-12
critical 9.8 The Events Calendar

Remote code execution

CVE-2026-78159 · affected 6.17.3 and older · fixed in 6.17.3.1 * · published 2026-09-12
critical 9.8 The Events Calendar

Remote code execution

CVE-2026-78006 · affected 6.17.4 and older · fixed in 6.17.4.1 * · published 2026-09-12
critical 9.9 Masteriyo LMS

Remote code execution

CVE-2026-82845 · affected older than 3.4.1 · fixed in 3.4.1 · published 2026-09-12
high 7.5 RepairBuddy

Remote code execution

CVE-2026-81803 · affected 4.1224 and older · fixed in 4.1225 · published 2026-09-10
medium 4.3 Checkout Custom Fields Builder for WooCommerce

Remote code execution

CVE-2026-19802 · affected 1.1.5 and older · fixed in 1.1.6 * · published 2026-09-09
high 8.8 FireBox

Remote code execution

CVE-2026-76801 · affected 3.1.10 and older · fixed in 3.1.11 * · published 2026-09-09
medium 6.5 Beaver Builder Page Builder

Remote code execution

CVE-2026-18021 · affected 2.10.3.1 and older · fixed in 2.10.3.2 * · published 2026-09-08
medium 6.5 Email Subscribers & Newsletters by Icegram Exp…

Remote code execution

CVE-2026-12757 · affected 5.9.27 and older · fixed in 5.9.28 * · published 2026-09-07
critical 9.8 Post Grid

Remote code execution

CVE-2024-11080 · affected 2.2.85 to 2.3.32 · fix not stated · published 2026-09-05
critical 9.8 Hummingbird Performance

Remote code execution

CVE-2026-83627 · affected 3.21.0 and older · fixed in 3.21.2 * · published 2026-09-05
high 7.2 Hummingbird Performance

Remote code execution

CVE-2026-19224 · affected 3.15.0 up to (not including) 3.21.2 · fixed in 3.21.2 · published 2026-09-04
medium 6.6 Really Simple Security

Remote code execution

CVE-2026-81766 · affected older than 9.8.0 · fixed in 9.8.0 · published 2026-08-30
high 7.2 Rank Math SEO

Remote code execution

CVE-2026-81757 · affected 1.0.276 and older · fixed in 1.0.277 · published 2026-08-28
high 7.2 User Frontend

Remote code execution

CVE-2026-14558 · affected older than 4.3.10 · fixed in 4.3.10 · published 2026-08-28
medium 6.5 Tutor LMS

Remote code execution

CVE-2026-16759 · affected 4.0.5 and older · fixed in 4.0.6 * · published 2026-08-28
critical 9.8 ERP

Remote code execution

CVE-2026-18080 · affected 1.17.8 and older · fixed in 1.17.9 * · published 2026-08-26
high 7.2 Pods

Remote code execution

CVE-2026-74851 · affected 3.1.0 up to (not including) 3.3.9.1 · fixed in 3.3.9.1 · published 2026-08-26
medium 5.3 kk Star Ratings

Remote code execution

CVE-2026-3424 · affected 5.4.10.3 and older · fixed in 5.4.10.4 * · published 2026-08-22
high 7.2 Forminator Forms

Remote code execution

CVE-2026-19221 · affected 1.40.0 up to (not including) 1.57.0.5 · fixed in 1.57.0.5 · published 2026-08-22
high 8.1 Drag and Drop Multiple File Upload for Contact…

Remote code execution

CVE-2026-18781 · affected older than 1.3.9.9 · fixed in 1.3.9.9 · published 2026-08-21
critical 9.9 Query Wrangler

Remote code execution

CVE-2026-73992 · affected 1.5.57 and older · fixed in 1.5.58 · published 2026-08-20
high 7.2 Depicter

Remote code execution

CVE-2026-15049 · affected older than 4.8.0 · fixed in 4.8.0 · published 2026-08-20
medium 6.6 Royal Addons for Elementor

Remote code execution

CVE-2026-13405 · affected older than 1.7.1066 · fixed in 1.7.1066 · published 2026-08-20
critical 9.0 Broken Link Checker

Remote code execution

CVE-2026-18937 · affected older than 2.4.12 · fixed in 2.4.12 · published 2026-08-19
critical 10.0 WP Compress

Remote code execution

CVE-2026-73343 · affected older than 7.20.01 · fixed in 7.20.01 · published 2026-08-18
high 7.2 WCPOS

Remote code execution

CVE-2026-17581 · affected 1.9.14 and older · fixed in 1.9.15 * · published 2026-08-16
medium 5.4 ProfilePress

Remote code execution

CVE-2026-18385 · affected 4.16.19 and older · fixed in 4.17.0 * · published 2026-08-16

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Arbitrary file upload · Path traversal and file read · Authentication bypass · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan