WordPress plugin vulnerabilities: week 3, 2026

89 vulnerabilities published Jan 12 – Jan 18, 2026 in 85 plugins we track, by day.

5 critical 11 high 72 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, January 17, 2026 · 22

• medium 4.4 Integrate Dynamics 365 CRM

  Stored cross-site scripting (XSS)

  CVE-2026-0725 · affected 1.1.1 and older · fixed in 1.1.2 *

• medium 6.4 CubeWP Framework

  Stored cross-site scripting (XSS)

  CVE-2025-8615 · affected 1.1.26 and older · fixed in 1.1.27 *

• medium 5.3 PAYGENT for WooCommerce

  Missing authorization check

  CVE-2025-14078 · affected 2.4.6 and older · fixed in 2.4.7 *

• high 7.5 Demo Importer Plus

  Security issue

  CVE-2025-14478 · affected 2.0.9 and older · fixed in 2.0.10 *

• medium 5.3 CubeWP Framework

  Information disclosure

  CVE-2025-12129 · affected 1.1.27 and older · fixed in 1.1.28 *

• medium 5.3 Spin Wheel

  Security issue

  CVE-2026-0808 · affected 2.1.0 and older · fixed in 2.1.1 *

• medium 6.4 Team Section Block

  Stored cross-site scripting (XSS)

  CVE-2026-0833 · affected 2.0.0 and older · fixed in 2.0.1 *

• medium 4.4 CM E-Mail Blacklist

  Stored cross-site scripting (XSS)

  CVE-2026-0691 · affected 1.6.2 and older · fixed in 1.6.5 *

• medium 4.9 Advanced Ads

  SQL injection

  CVE-2025-12984 · affected 2.0.15 and older · fixed in 2.0.16 *

• medium 5.3 Community Events

  Missing authorization check

  CVE-2025-14029 · affected 1.5.6 and older · fixed in 1.5.7 *

• medium 5.3 User Registration Using Contact Form 7

  Missing authorization check

  CVE-2025-12825 · affected 2.5 and older · fixed in 2.6 *

• medium 4.3 Phrase TMS Integration for WordPress

  Missing authorization check

  CVE-2025-12168 · affected 4.7.5 and older · fixed in 4.7.6 *

• medium 4.3 RepairBuddy

  Missing authorization check

  CVE-2026-0820 · affected 4.1116 and older · fixed in 4.1125 *

• low 2.2 Church Admin

  Server-side request forgery (SSRF)

  CVE-2026-0682 · affected 5.0.28 and older · fixed in 5.0.29 *

• medium 5.3 Payment Button for PayPal

  Missing authorization check

  CVE-2025-14463 · affected 1.2.3.41 and older · fixed in 1.2.3.42 *

• medium 6.5 Thim Blocks

  Path traversal / file read

  CVE-2025-13725 · affected 1.0.1 and older · fixed in 1.0.2 *

• critical 9.8 RegistrationMagic

  Privilege escalation

  CVE-2025-15403 · affected 6.0.7.1 and older · fixed in 6.0.7.2 *

• medium 4.4 Filr

  Stored cross-site scripting (XSS)

  CVE-2025-14632 · affected 1.2.11 and older · fixed in 1.2.12 *

• medium 5.8 Quick Contact Form

  Security issue

  CVE-2025-12718 · affected 8.2.6 and older · fixed in 8.2.7 *

• medium 6.5 Wallet System for WooCommerce

  Missing authorization check

  CVE-2025-14450 · affected 2.7.2 and older · fixed in 2.7.3 *

• medium 5.3 WP Hotel Booking

  Information disclosure

  CVE-2025-14075 · affected 2.2.7 and older · fixed in 2.2.8 *

• medium 5.9 Feeds for YouTube (YouTube video, channel, and…

  Path traversal / file read

  CVE-2025-12002 · affected 2.6.0 and older · fixed in 2.6.1 *

Friday, January 16, 2026 · 19

• critical 10.0 Modular DS

  Privilege escalation

  CVE-2026-23800 · affected 2.5.2 up to (not including) 2.6.0 · fixed in 2.6.0

• high 7.5 Membership Plugin

  Missing authorization check

  CVE-2025-14844 · affected 3.2.16 and older · fixed in 3.2.17 *

• medium 5.3 Essential Addons for Elementor

  Information disclosure

  CVE-2026-1004 · affected 6.5.5 and older · fixed in 6.5.6 *

• medium 6.4 User Submitted Posts

  Stored cross-site scripting (XSS)

  CVE-2026-0913 · affected 20260110 and older · fixed in 20260113 *

• medium 5.3 Cost Calculator Builder

  Missing authorization check

  CVE-2025-14757 · affected 3.6.9 and older · fixed in 3.6.10 *

• medium 4.3 GetGenie

  Missing authorization check

  CVE-2026-1003 · affected 4.3.0 and older · fixed in 4.3.1 *

• medium 6.1 WP RSS Aggregator

  Reflected cross-site scripting (XSS)

  CVE-2025-14375 · affected 5.0.10 and older · fixed in 5.0.11 *

• medium 5.3 Rede Itaú for WooCommerce

  Missing authorization check

  CVE-2026-0942 · affected 5.1.5 and older · fixed in 5.1.6 *

• medium 4.3 LEAV Last Email Address Validator

  Cross-site request forgery (CSRF)

  CVE-2025-14853 · affected 1.7.1 and older · fix not stated

• medium 6.4 Related Posts by Taxonomy

  Stored cross-site scripting (XSS)

  CVE-2026-0916 · affected 2.7.6 and older · fixed in 2.7.7 *

• medium 5.3 Rede Itaú for WooCommerce

  Security issue

  CVE-2026-0939 · affected 5.1.2 and older · fixed in 5.1.3 *

• medium 5.0 DK PDF

  Server-side request forgery (SSRF)

  CVE-2025-14793 · affected 2.3.0 and older · fixed in 2.3.1 *

• medium 6.5 MailerLite

  Missing authorization check

  CVE-2026-1000 · affected 3.1.3 and older · fixed in 3.1.4 *

• medium 4.3 WP Recipe Maker

  Information disclosure

  CVE-2025-15527 · affected 10.2.2 and older · fixed in 10.2.3 *

• medium 4.3 Booking Calendar

  Missing authorization check

  CVE-2025-14982 · affected 10.14.11 and older · fixed in 10.14.12 *

• medium 4.3 Shield Security

  Missing authorization check

  CVE-2025-15370 · affected 21.0.9 and older · fixed in 21.0.10 *

• medium 4.3 All in One SEO

  Missing authorization check

  CVE-2025-14384 · affected 4.9.2 and older · fixed in 4.9.5 *

• high 8.8 All-in-One Video Gallery

  Arbitrary file upload

  CVE-2025-12957 · affected 4.5.7 and older · fixed in 4.6.4 *

• medium 6.5 Awesome Support

  Missing authorization check

  CVE-2025-12641 · affected 6.3.6 and older · fixed in 6.3.7 *

Thursday, January 15, 2026 · 4

• medium 6.4 AffiliateX

  Missing authorization check

  CVE-2025-13859 · affected 1.0.0 to 1.3.9.3 · fixed in 1.4.0 *

• high 8.8 Supreme Modules Lite

  Arbitrary file upload

  CVE-2025-13062 · affected 2.5.62 and older · fixed in 2.5.63 *

• high 7.4 Drag and Drop Multiple File Upload for Contact…

  Missing authorization check

  CVE-2025-14457 · affected 1.3.9.2 and older · fixed in 1.3.9.3 *

• medium 5.4 WP-Members Membership Plugin

  Stored cross-site scripting (XSS)

  CVE-2025-14448 · affected 3.5.4.3 and older · fixed in 3.5.4.4 *

Wednesday, January 14, 2026 · 39

• critical 9.8 Modular DS

  Privilege escalation

  CVE-2026-23550 · affected 2.5.1 and older · fixed in 2.5.2

• medium 4.4 Short Link

  Stored cross-site scripting (XSS)

  CVE-2026-0813 · affected 1.0 and older · fix not stated

• medium 4.4 Electric Studio Download Counter

  Stored cross-site scripting (XSS)

  CVE-2026-0741 · affected 2.4 and older · fix not stated

• medium 4.4 LinkedIn SC

  Stored cross-site scripting (XSS)

  CVE-2026-0812 · affected 1.1.9 and older · fix not stated

• medium 4.4 WMF Mobile Redirector

  Stored cross-site scripting (XSS)

  CVE-2026-0739 · affected 1.2 and older · fix not stated

• medium 4.4 WP Allowed Hosts

  Stored cross-site scripting (XSS)

  CVE-2026-0734 · affected 1.0.8 and older · fix not stated

• medium 5.3 Aplazo Payment Gateway

  Missing authorization check

  CVE-2025-15512 · affected 1.4.3 and older · fixed in 1.5.0 *

• medium 5.3 Float Payment Gateway

  Missing authorization check

  CVE-2025-15513 · affected 1.1.9 and older · fixed in 1.1.10 *

• medium 5.3 PayHere Payment Gateway

  Missing authorization check

  CVE-2025-15475 · affected 2.3.9 and older · fixed in 2.4.0 *

• medium 4.3 Auto Post to Social Media from Social Champ

  Cross-site request forgery (CSRF)

  CVE-2025-14846 · affected 1.3.5 and older · fixed in 1.3.6 *

• high 7.5 Shipping Rate By Cities

  SQL injection

  CVE-2025-14770 · affected 2.0.0 and older · fixed in 2.0.1 *

• medium 4.3 Stopwords for comments

  Cross-site request forgery (CSRF)

  CVE-2025-15376 · affected 1.1 and older · fix not stated

• medium 5.3 Perfit WooCommerce

  Missing authorization check

  CVE-2025-14173 · affected 1.0.1 and older · fix not stated

• medium 4.9 Shipping Rates by City for WooCommerce

  SQL injection

  CVE-2026-0678 · affected 1.0.3 and older · fix not stated

• medium 5.3 LottieFiles

  Information disclosure

  CVE-2026-0717 · affected 3.0.0 and older · fix not stated

• medium 4.4 Real Post Slider Lite

  Stored cross-site scripting (XSS)

  CVE-2026-0680 · affected 2.4 and older · fix not stated

• medium 4.3 Responsive Accordion Slider

  Missing authorization check

  CVE-2026-0635 · affected 1.2.2 and older · fix not stated

• medium 6.4 SearchWiz

  Stored cross-site scripting (XSS)

  CVE-2026-0694 · affected 1.0.0 and older · fix not stated

• high 7.2 AJS Footnotes

  Stored cross-site scripting (XSS)

  CVE-2025-15378 · affected 1.0 and older · fix not stated

• medium 4.4 Kunze Law

  Stored cross-site scripting (XSS)

  CVE-2025-15486 · affected 2.1 and older · fix not stated

• medium 6.1 List Site Contributors

  Reflected cross-site scripting (XSS)

  CVE-2026-0594 · affected 1.1.8 and older · fix not stated

• high 7.2 Name Directory

  Stored cross-site scripting (XSS)

  CVE-2025-15283 · affected 1.30.3 and older · fixed in 1.31.0 *

• medium 4.3 Sosh Share Buttons

  Cross-site request forgery (CSRF)

  CVE-2025-15377 · affected 1.1.0 and older · fix not stated

• high 7.1 DASHBOARD BUILDER

  Cross-site request forgery (CSRF)

  CVE-2025-14615 · affected 1.5.7 and older · fix not stated

• high 7.2 Geeky Bot

  Stored cross-site scripting (XSS)

  CVE-2025-15266 · affected 1.1.8 and older · fixed in 1.2.7 *

• medium 4.4 Gotham Block Extra Light

  Stored cross-site scripting (XSS)

  CVE-2025-15021 · affected 1.5.0 and older · fix not stated

• medium 6.5 Gotham Block Extra Light

  Path traversal / file read

  CVE-2025-15020 · affected 1.5.0 and older · fix not stated

• medium 4.4 Internal Link Builder

  Stored cross-site scripting (XSS)

  CVE-2025-14725 · affected 1.0 and older · fix not stated

• medium 5.3 Netcash WooCommerce Payment Gateway

  Missing authorization check

  CVE-2025-14880 · affected 4.1.3 and older · fixed in 4.1.4 *

• medium 5.4 WP-CRM System

  Missing authorization check

  CVE-2025-14854 · affected 3.4.5 and older · fixed in 3.4.6 *

• medium 4.3 Crush.pics Image Optimizer

  Missing authorization check

  CVE-2025-14482 · affected 1.8.7 and older · fix not stated

• high 7.2 GetContentFromURL

  Server-side request forgery (SSRF)

  CVE-2025-14613 · affected 1.0 and older · fix not stated

• critical 9.8 News and Blog Designer Bundle

  File inclusion

  CVE-2025-14502 · affected 1.1 and older · fix not stated

• medium 5.3 PDF Resume Parser

  Information disclosure

  CVE-2025-14464 · affected 1.0 and older · fix not stated

• medium 4.4 Testimonials Creator

  Stored cross-site scripting (XSS)

  CVE-2025-14379 · affected 1.6 only · fix not stated

• medium 4.3 WPBlogSyn

  Cross-site request forgery (CSRF)

  CVE-2025-14389 · affected 1.0 and older · fix not stated

• medium 4.4 Makesweat

  Stored cross-site scripting (XSS)

  CVE-2025-13627 · affected 0.1 and older · fix not stated

• critical 9.8 Integration Opvius AI for WooCommerce

  Path traversal / file read

  CVE-2025-14301 · affected 1.3.0 and older · fix not stated

• medium 6.4 SpiceForms Form Builder

  Stored cross-site scripting (XSS)

  CVE-2025-12178 · affected 1.0 and older · fix not stated

Tuesday, January 13, 2026 · 5

• medium 6.1 Jetpack

  Cross-site scripting (XSS)

  CVE-2023-54332 · affected 11.4 only · fixed in 11.4.1 *

• medium 6.1 WPForms

  Cross-site scripting (XSS)

  CVE-2020-36919 · affected 1.7.8 and older · fixed in 1.7.9 *

• medium 4.3 CP Image Store with Slideshow

  Missing authorization check

  CVE-2026-0684 · affected 1.1.9 and older · fixed in 1.2.0 *

• medium 5.3 EventPrime

  Information disclosure

  CVE-2025-14507 · affected 4.2.7.0 and older · fixed in 4.2.8.0 *

• medium 5.4 WP Duplicate Page

  Missing authorization check

  CVE-2025-14001 · affected 1.8 and older · fixed in 1.8.1 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan