WordPress plugin vulnerabilities: week 2, 2026
227 vulnerabilities published Jan 5 – Jan 11, 2026 in 211 plugins we track, by day.
9 critical 41 high 176 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, January 10, 2026 · 9
-
medium 4.3 Featured Image from URL (FIFU)
-
medium 6.4 Countdown Timer
-
medium 6.4 ConvertForce
-
medium 5.3 Templately
-
medium 5.4 User Registration & Membership
-
medium 4.3 Blog2Social
-
high 7.5 WooCommerce Square
Friday, January 9, 2026 · 40
-
medium 6.5 WP Page Permalink Extension
-
medium 6.4 Woodpecker for WordPress
-
medium 6.4 Curved Text
-
medium 6.1 Lesson Plan Book
-
medium 6.4 Menu Card
-
medium 6.1 MG AdvancedOptions
-
medium 6.4 PullQuote
-
medium 6.4 The Tooltip
-
medium 6.4 Client Testimonial Slider
-
medium 6.4 Autogen Headers Menu
-
medium 5.3 Contact Form vCard Generator
-
medium 6.4 Debt.com Business in a Box
-
medium 6.1 Shabat Keeper
-
medium 6.4 Header and Footer Scripts
-
medium 6.4 WP Popup Magic
-
medium 6.4 Entry Views
-
medium 6.4 Nearby Now Reviews
-
medium 6.1 Top Position Google Finance
-
medium 6.4 AMP for WP
-
high 7.2 ACF Frontend Admin by DynamiApps
-
critical 9.1 ACF Frontend Admin by DynamiApps
-
medium 5.3 Booking Calendar
-
medium 4.3 Tutor LMS
-
medium 4.3 Tutor LMS
-
high 7.2 Eventin
-
medium 4.3 Tutor LMS
-
medium 4.3 WP Table Builder
-
high 7.2 SlimStat Analytics
-
high 7.2 SlimStat Analytics
-
critical 9.8 ACF Frontend Admin by DynamiApps
-
medium 5.3 Booking for Appointments and Events Calendar
-
medium 6.5 BetterDocs
-
medium 5.3 Forminator Forms
-
medium 5.3 weDocs
-
medium 6.8 NEX-Forms
-
medium 4.3 Clearfy Cache
-
medium 5.3 Japanized for WooCommerce
Thursday, January 8, 2026 · 36
-
high 7.2 Brevo for WooCommerce
-
medium 6.5 affects latest 2.2.3 Block Slider
-
medium 5.3 affects latest 1.0.8 Dashboard Welcome for Beaver Builder
-
medium 4.3 Docket Cache
-
medium 5.4 TrueAna
-
medium 4.3 Image Slider Slideshow
-
medium 5.4 Bulk Page Generator
-
medium 6.5 MediaPress
-
medium 6.5 X Addons for Elementor
-
medium 4.3 affects latest 2.0.2 Speed Kit
-
medium 5.3 Photo Gallery by Re Gallery
-
high 7.1 affects latest 1.0.4 e-shopsカート2
-
medium 5.4 Easy Media Download
-
medium 4.3 Campaign Monitor for WordPress
-
high 7.1 affects latest 4.0.0 Pinpoll
-
high 7.1 affects latest 5.0 Scroll rss excerpt
-
high 7.1 WP App Bar
-
medium 6.5 affects latest 1.2.1 Effect Maker
-
medium 6.5 affects latest 1.0.3 Flaming Password Reset
-
high 7.1 affects latest 1.0.25 PRIMER by chloédigital
-
high 7.1 affects latest 1.5.0 Visitor Stats Widget
-
high 7.1 WP-BusinessDirectory
-
high 7.5 BulletProof Security
-
high 7.1 Taskbuilder
-
high 7.1 eHive Search
-
medium 6.5 Fluent Support
-
high 7.1 Link Whisper Free
-
medium 6.5 Aruba HiSpeed Cache
-
high 8.8 Timetics
-
critical 9.1 ContentStudio
-
critical 9.8 Newsletters
-
high 7.5 Blockons
-
medium 6.4 Gutenverse Form
-
medium 6.5 Tutor LMS
-
medium 6.4 Jeg Kit for Elementor
-
medium 4.3 Folders
Wednesday, January 7, 2026 · 80
-
medium 4.9 External Media
-
medium 6.4 Responsive Pricing Table
-
high 8.8 WP Enable WebP
-
medium 4.3 Latest Tabs
-
medium 4.3 Newsletter Email Subscribe
-
critical 9.8 Optional Email
-
medium 4.4 Page Keys
-
medium 6.5 Bit Form
-
medium 6.4 Customer Reviews for WooCommerce
-
medium 6.5 Flashcard Plugin for WordPress
-
medium 4.3 NS Ie Compatibility Fixer
-
medium 4.4 Simple User Meta Editor
-
medium 4.4 twinklesmtp
-
medium 4.4 Key Figures
-
medium 5.4 LearnPress
-
medium 6.4 My Album Gallery
-
high 7.7 Frontend File Manager Plugin
Security issue
-
medium 4.9 Relevanssi
-
high 7.1 WP Photo Album Plus
-
medium 4.3 AMP for WP
-
medium 4.3 Sticky Action Buttons
-
medium 5.3 affects latest 1.0.3 Awesome Hotel Booking
-
medium 6.4 Easy GitHub Gist Shortcodes
-
medium 6.4 My Album Gallery
-
medium 6.4 Niche Hero
-
medium 4.3 Quote Comments
-
medium 5.3 Piraeus Bank WooCommerce Payment Gateway
-
medium 6.4 AD Sliding FAQ
-
medium 6.4 EDD Download Info
-
medium 6.4 Mstoic Shortcodes
-
medium 6.1 Post Like Dislike
-
medium 6.1 Stumble! for WordPress
-
medium 6.1 Testimonial Master
-
medium 6.1 WP Widget Changer
-
medium 6.4 1180px Shortcodes
-
medium 6.4 AH Shortcodes
-
medium 6.4 Snillrik Restaurant Menu
-
medium 6.1 Starred Review
-
medium 6.4 Viitor Button Shortcodes
-
medium 6.4 WP Js List Pages Shortcodes
-
medium 4.4 Contact Us Simple Form
-
medium 6.5 EmailKit
-
medium 4.3 Mamurjor Employee Info
-
medium 4.4 Multi-column Tag Map
-
high 7.5 Reviewify
-
medium 4.3 Simcast
-
medium 6.4 Travel Bucket List
-
medium 6.4 AI ChatBot for WordPress by AI BotKit
-
medium 6.4 Cool YT Player
-
medium 4.4 Email Customizer for WooCommerce
-
medium 6.4 PhotoFade
-
medium 6.4 Smart App Banners
-
medium 6.4 STM Gallery 1.9
-
high 7.5 Yoco Payments
-
medium 5.3 AA Block country
Security issue
-
medium 5.3 Fluent Forms
-
medium 4.3 HelpDesk.com Contact Form
-
medium 6.4 Stylish Order Form Builder
-
medium 5.3 Unify
-
medium 6.4 WP Recipe Manager
-
high 7.5 Latest Registered Users
-
medium 5.3 Moosend Landing Pages
-
medium 4.3 MTCaptcha WordPress Plugin
-
medium 6.4 Recras
-
medium 6.1 SVG Map by Smjrifle
-
medium 4.3 WP Status Notifier
-
medium 4.3 xShare
-
medium 6.4 Responsive Pricing Table
-
high 8.6 Money Space
-
low 2.7 Rankology SEO and Analytics Tool
-
medium 6.1 Premmerce WooCommerce Customers Manager
-
medium 5.3 WP-Members Membership Plugin
Security issue
-
medium 5.4 aBlocks
-
medium 4.3 ACF to REST API
-
medium 4.7 ShareThis Dashboard for Google Analytics
-
high 7.5 User Activity Log
Tuesday, January 6, 2026 · 47
-
medium 5.3 Breeze Cache
-
medium 5.3 Creator LMS
-
medium 6.5 Responsive Addons for Elementor
-
medium 4.3 Tickera
-
medium 5.9 UiChemy
-
medium 5.9 Accordions
-
medium 4.3 AffiliateX
-
medium 4.3 Better Business Reviews
-
medium 4.3 Event Countdown for The Events Calendar
-
high 8.5 Ninja Tables
-
medium 4.3 Proxy & VPN Blocker
-
medium 5.4 RSS Feed Widget
-
medium 5.4 The Events Calendar
-
medium 4.3 Post and Page Builder by BoldGrid
-
medium 6.5 Team Showcase
-
medium 4.3 Ultimate Store Kit
-
medium 6.5 Wishlist for WooCommerce
-
medium 4.3 Car Rental Manager
-
high 7.1 Photo Gallery
-
medium 4.3 Theater for WordPress
-
medium 6.5 AdsPlace'r
-
high 7.1 Header Image Slider
-
medium 6.4 MediaPress
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 4.3 Quiz and Survey Master (QSM)
-
medium 5.3 LearnPress
-
medium 6.5 Timetics
-
medium 5.4 MasterStudy LMS WordPress Plugin
-
medium 6.4 Table Field Add-on for ACF and SCF
-
medium 4.3 PublishPress Taxonomies
-
critical 9.8 FS Registration Password
-
critical 9.8 AS Password Field In Default Registration Form
-
medium 6.4 Xagio SEO & AEO
-
medium 6.4 URL Image Importer
-
medium 6.5 FastDup
-
medium 6.5 Page Expire Popup/Redirection for WordPress
-
medium 5.3 ilGhera Support System for WooCommerce
-
medium 6.5 CBX Bookmark & Favorite
-
medium 4.9 Form Vibes
-
medium 6.4 ForumWP
-
medium 5.3 Depicter
-
high 7.3 Download Manager
Monday, January 5, 2026 · 15
-
high 7.5 Booking Package
Security issue
-
high 7.1 iPhone Webclip Manager
-
high 7.1 Tumult Hype Animations
-
medium 6.5 Geo Controller
-
critical 9.1 Media File Renamer
-
medium 6.5 The Plus Addons for Elementor
-
medium 5.4 WP Job Manager
-
critical 9.3 Infility Global
-
high 7.5 Sell Downloads
-
medium 6.5 affects latest 3.2.26 AweBooking
-
high 7.5 Custom Related Posts
-
high 7.5 Follow My Blog Post
-
high 8.6 Five Star Restaurant Reservations
-
medium 6.3 Wallet System for WooCommerce
-
high 8.5 Premium SEO Pack
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.