WordPress plugin vulnerabilities: week 1, 2026
195 vulnerabilities published Dec 29, 2025 – Jan 4, 2026 in 186 plugins we track, by day.
5 critical 36 high 153 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Friday, January 2, 2026 · 6
-
medium 6.1 Logo Slider
-
medium 5.3 Ninja Forms
Security issue
-
medium 6.1 ShopBuilder
-
medium 6.5 WPBookit
-
critical 9.8 Branda
-
medium 5.3 User Frontend
Thursday, January 1, 2026 · 2
-
medium 6.4 WP Ultimate CSV Importer
Wednesday, December 31, 2025 · 118
-
high 7.1 Easy Social
-
high 7.1 Blappsta Mobile App Plugin
-
high 7.1 En Masse WordPress
-
high 7.1 ZD Scribd iPaper
-
high 7.1 ZhinaTwitterWidget
-
high 7.1 Zielke Design Project Gallery
-
high 7.1 custom-post-edit
-
medium 5.9 Cooked
-
medium 5.9 affects latest 1.0.2 Accessibility Press
-
high 7.1 LIVE TV
-
medium 5.9 Behance Portfolio Manager
-
medium 5.9 affects latest 1.2.0 Dashboard Beacon
-
medium 4.3 WP Custom Admin Interface
-
medium 4.3 AnyComment
-
medium 4.3 affects latest 0.5.77 Co-marquage service-public.fr
-
medium 4.3 affects latest 1.0.4 Hide Plugins
-
medium 4.3 affects latest 1.0.7 WP Gmail SMTP
-
medium 4.3 Easy Upload Files During Checkout
-
medium 4.3 Signature Add-On for Gravity Forms
-
medium 4.3 affects latest 3.0.0 پلاگین پرداخت دلخواه
-
medium 4.3 Direct Payments WP
-
medium 4.3 Order Cancellation & Returns for WooCommerce
-
medium 4.3 Direct Payments WP
-
medium 4.3 All in One Accessibility
-
medium 4.3 Gmedia Photo Gallery
-
medium 5.3 GS Portfolio for Envato
-
medium 4.3 Post Snippets
-
medium 4.3 affects latest 1.1.7 AI Content Writing Assistant
-
medium 5.3 affects latest 1.3.4 Featured Image Generator
-
medium 4.3 affects latest 1.6.1 Robots.txt rewrite
-
medium 4.3 affects latest 1.0.6 History Timeline for Biography, Company Histor…
-
medium 4.3 Cincopa video and media plug-in
-
medium 4.3 affects latest 2.7 Accordion Slider Gallery
-
medium 4.3 FormFacade
-
medium 5.3 RestroPress
-
medium 4.3 Tasty Recipes Lite
-
medium 4.3 Tasty Recipes Lite
-
medium 5.3 affects latest 1.9.1 Trash Duplicate and 301 Redirect
-
medium 5.3 affects latest 1.8.3 Varnish/Nginx Proxy Caching
-
medium 5.3 AI Copilot
-
medium 5.3 affects latest 0.2.1 Download Media Library
-
medium 4.3 iNext Woo Pincode Checker
-
medium 4.3 Mergado Pack
-
medium 4.3 Sticky Notes for WP Dashboard
-
medium 5.3 Wiremo
-
medium 4.3 Appointify
-
medium 5.3 affects latest 1.1.6 Flowbox
-
medium 4.3 Orders Chat for WooCommerce
-
medium 5.3 Efí Bank
-
medium 5.3 affects latest 1.0.3 WP Export Categories & Taxonomies
-
medium 5.3 MyD Delivery
-
medium 5.3 EasyTest
-
medium 5.3 Master Addons for Elementor
-
medium 5.3 Simple Like Page
-
medium 5.3 QuadLayers TikTok Feed
-
medium 5.3 DMCA Website Protection Badge
-
medium 5.3 Hotel Booking
-
medium 5.3 affects latest 1.1.3 Realbig For WordPress
-
medium 5.4 WP Attachments
-
medium 5.4 Add Custom Codes
-
medium 5.4 affects latest 1.4.8 Portfolio Gallery
-
medium 5.3 affects latest 3.4.10 Terms descriptions
-
medium 5.3 Reuters Direct
-
medium 6.5 Postie
-
medium 5.9 Add Custom Codes
-
medium 5.4 Core Web Vitals & PageSpeed Booster
-
medium 5.9 Locatoraid Store Locator
-
medium 5.4 Contact Form Widget
-
medium 5.9 Cincopa video and media plug-in
-
medium 5.9 Installment Prices for WooCommerce
-
medium 5.3 affects latest 1.1.7 WP Advanced PDF
-
medium 5.9 affects latest 2.0.0 Add Featured Image Custom Link
-
medium 5.4 affects latest 1.1.1704 EasyIndex
-
medium 6.5 Maximum Products per User for WooCommerce
-
medium 6.5 SEO Slider
-
medium 5.9 affects latest 1.8.1 Logo Slider , Logo Carousel , Logo showcase ,…
-
medium 5.4 affects latest 4.3.1 OpenHook
-
medium 5.9 affects latest 0.4.1 WP Post Signature
-
medium 6.5 affects latest 1.3.2 Bootstrap Modals
-
medium 6.5 Livemesh Addons for Beaver Builder
-
medium 6.5 affects latest 2.5.9 Page Title Splitter
-
medium 6.5 affects latest 1.0 AdWords Conversion Tracking Code
-
medium 6.5 Curator.io
-
medium 6.5 Custom Background Changer
-
medium 6.5 affects latest 2.2 Extra Shortcodes
-
medium 6.5 MyBookTable Bookstore by Stormhill Media
-
medium 6.5 affects latest 1.4.8 Audiomack
-
medium 6.5 Calendar.online / Kalender.digital
-
medium 6.5 The Moneytizer
-
medium 6.5 affects latest 1.0.6 User Specific Content
-
medium 6.5 WebMan Amplifier
-
medium 6.5 Responsive Block Control
-
medium 6.5 affects latest 1.1 Content Fetcher
-
high 8.1 Everest Backup
-
medium 6.5 Sermon Manager
-
medium 6.5 affects latest 10.9.3 Tooltips for WordPress
-
medium 6.5 Knowledge Base documentation & wiki plugin
-
medium 6.5 BuddyPress Activity Shortcode
-
medium 6.5 Funnelforms Free
-
medium 6.5 MX Time Zone Clocks
-
medium 6.5 affects latest 2.0.1 Series
-
high 7.1 Zoho ZeptoMail
-
medium 4.3 Easy Digital Downloads
-
high 7.1 affects latest 1.1.0 Custom Post Status
-
high 7.1 affects latest 1.0 Noindex by Path
-
high 7.1 affects latest 1.4 Recent Posts From Each Category
-
high 7.1 affects latest 1.0 Custom Style
-
high 7.1 affects latest 1.4.1 SensitiveTagCloud
-
high 7.1 affects latest 1.0 Social Profilr
-
high 7.1 affects latest 3.1.2 WP-EasyArchives
-
high 7.1 Behance Portfolio Manager
-
high 7.1 affects latest 5.2 Simple Archive Generator
Tuesday, December 30, 2025 · 53
-
high 7.5 MAS Videos
-
high 7.1 affects latest 1.3.4 WP-CalDav2ICS
-
medium 6.5 WPCal.io
-
medium 6.5 Yada Wiki
-
high 7.6 Appointify
-
medium 4.3 Import into Easy Property Listings
-
medium 4.3 SiteLock Security
-
critical 9.6 WING Website Migrator
-
medium 5.3 WPLP Cookie Consent
-
medium 6.5 Featured Video for WordPress
-
medium 4.3 Strong Testimonials
-
high 7.2 Lucky Wheel for WooCommerce
-
medium 6.5 Auto Listings
-
medium 4.3 Demo Importer Plus
-
medium 6.5 Essential Addons for Elementor
-
medium 5.3 ShopMagic
-
medium 6.5 Combo Offers WooCommerce
-
medium 6.5 Blog Filter
-
medium 4.3 Poptics
-
medium 5.3 Product Delivery Date for WooCommerce
-
medium 5.3 weForms
-
medium 5.4 Popup Box
-
medium 6.5 FlippingBook
-
medium 5.4 HR Management Lite
-
medium 6.5 Newsletters
-
medium 6.5 RestroPress
-
medium 6.5 Web Directory plugin Free
-
medium 4.3 Discussion Board
-
low 3.8 Crowdsignal Forms
-
medium 4.3 Event Organiser
-
medium 5.9 affects latest 1.0.4 Inboxify Sign Up Form
-
medium 4.3 Stratum Widgets for Elementor
-
medium 5.3 Themebeez Toolkit
-
medium 4.9 affects latest 1.3.7 Youzify
-
medium 5.9 affects latest 1.13.1 AM Events
-
medium 5.4 Heateor Social Login WordPress
-
medium 5.9 affects latest 1.27 Popping Sidebars and Widgets Light
-
medium 5.3 Comments
-
medium 5.3 affects latest 1.3.0 EInvoice App Malaysia
-
medium 5.3 Simple Calendar
-
medium 6.6 Social Login, Social Sharing by miniOrange
-
high 7.5 CubeWP Framework
-
medium 6.5 Project Manager
-
high 7.1 Off Page SEO
-
high 7.1 Product Puller
-
high 7.1 Sleekplan
-
high 7.1 Ads24 Lite
-
medium 5.4 Better Addons for Elementor
Monday, December 29, 2025 · 16
-
medium 6.5 Custom Field Template
-
critical 9.9 MapSVG
-
critical 9.8 Mobile builder
-
high 7.2 Advanced Ads
-
medium 5.3 PixelYourSite
-
high 7.1 affects latest 1.3.7 Plugin Optimizer
-
high 7.5 affects latest 1.0.0 CookieHint WP
-
medium 6.5 affects latest 1.0 Wp Text Slider Widget
-
high 7.1 affects latest 1.1.0 Advanced Custom CSS
-
high 7.1 affects latest 1.5 Content Grid Slider
-
critical 9.9 affects latest 1.2 IF AS Shortcode
-
medium 4.9 WordPress Image shrinker
-
high 7.5 affects latest 1.0.6 CedCommerce Integration for Good Market
-
high 7.1 affects latest 1.0.8 Invelity SPS connect
-
medium 5.9 YaMaps for WordPress Plugin
-
high 8.6 Plugin Organizer
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.