WordPress plugin vulnerabilities: week 4, 2026
280 vulnerabilities published Jan 19 – Jan 25, 2026 in 267 plugins we track, by day.
13 critical 56 high 209 medium 2 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, January 25, 2026 · 1
-
medium 4.3 CubeWP Framework
Saturday, January 24, 2026 · 45
-
medium 5.3 WP Go Maps
-
medium 6.1 Save as PDF Plugin by PDFCrowd
-
high 7.5 Hustle
-
medium 5.3 WP Directory Kit
-
medium 4.3 Friendly Functions for Welcart
-
medium 4.4 Meta-box GalleryMeta
-
medium 4.4 Postalicious
-
medium 4.4 Responsive Header Plugin
-
medium 6.4 CM CSS Columns
-
medium 4.4 JavaScript Notifier
-
medium 6.4 LeadBI Plugin for WordPress
-
medium 4.3 Meta-box GalleryMeta
-
medium 6.1 Timeline Event History
-
high 7.2 User Submitted Posts
-
medium 4.3 AdminQuickbar
-
medium 4.3 All-in-One Video Gallery
-
low 3.7 MetForm
-
medium 4.3 Moderate Selected Posts
-
medium 4.3 SurveyJS
-
medium 4.3 SurveyJS
-
medium 4.3 SurveyJS
-
high 7.5 Administrative Shortcodes
-
medium 6.4 Administrative Shortcodes
-
medium 5.4 AIKTP
-
medium 6.4 ThemeRuby Multi Authors
-
medium 6.4 Canto Testimonials
-
medium 4.4 Cookie consent for developers
-
medium 4.3 Login Page Editor
-
medium 4.3 Set Bulk Post Categories
-
medium 4.3 Star Review Manager
-
high 7.2 Frontis Blocks
-
medium 4.3 Alex User Counter
-
medium 4.9 WP-ClanWars
-
medium 4.3 ZT Captcha
-
medium 6.4 affects latest 1.5.0 Alpha Blocks
-
medium 6.4 GZSEO
-
medium 4.3 Simple Crypto Shortcodes
-
medium 5.3 Wizit Gateway for WooCommerce
-
medium 4.3 WP Youtube Video Gallery
-
medium 5.3 Alchemist Ajax Upload
-
medium 6.1 JustClick registration plugin
-
critical 9.8 KalravAI Agent
-
medium 5.4 Same Category Posts
-
medium 5.3 Wise Analytics
-
medium 6.4 VK Google Job Posting Manager
Friday, January 23, 2026 · 93
-
medium 6.5 All-in-One Video Gallery
-
medium 4.3 Sugar Calendar
-
medium 5.3 Ultimate Reviews
-
medium 5.9 affects latest 2.1.0 Web Accessibility with Max Access
-
medium 5.3 AEH Speed Optimization
-
medium 5.9 affects latest 1.0.0 Delay Redirects
-
medium 6.5 Stylish Cost Calculator
-
medium 4.3 Trusona for WordPress
-
medium 5.9 Logo Slider WP
-
high 7.6 affects latest 1.0 Neoforum
-
high 7.1 affects latest 1.0 Neoforum
-
medium 5.9 Landing Page Builder
-
medium 5.4 affects latest 5.0 Suggestion Toolkit
-
medium 5.9 Terms descriptions
-
medium 5.3 File Uploads Addon for WooCommerce
-
medium 6.5 Easy Modal
-
medium 5.3 Ecwid by Lightspeed Ecommerce Shopping Cart
-
medium 5.9 Flex QR Code Generator
-
medium 5.3 PopCash Code Integration Tool
-
medium 6.5 WP Popups
-
medium 5.3 Bayarcash WooCommerce
-
medium 5.3 Simple GDPR Cookie Compliance
-
medium 4.3 X Addons for Elementor
-
medium 5.3 affects latest 1.1.8 Universal Google Adsense and Ads manager
-
medium 5.3 NextMove Lite
-
medium 5.9 WPBakery Page Builder Addons by Livemesh
-
medium 5.3 AWP Classifieds
-
medium 6.5 affects latest 1.0.6 Turn Yoast SEO FAQ Block to Accordion
-
medium 4.3 Multilanguage by BestWebSoft
-
medium 4.3 Related Posts Thumbnails
-
medium 5.4 Zoho CRM Lead Magnet
-
medium 5.4 affects latest 0.10.210305 AJAX Hits Counter + Popular Posts Widget
-
medium 5.3 Cargus
-
medium 5.4 Points and Rewards for WooCommerce
-
medium 5.3 SumUp Payment Gateway For WooCommerce
-
medium 5.9 Tutor LMS BunnyNet Integration
-
medium 4.3 Admin login URL Change
-
medium 4.3 Ai Image Alt Text Generator for WP
-
medium 4.3 BOX NOW Delivery
-
medium 4.3 Ecwid by Lightspeed Ecommerce Shopping Cart
-
high 8.5 Nelio Content
-
medium 5.3 Pie Register
-
medium 6.5 affects latest 5.4.0 UX Flat
-
medium 4.3 Anything Order by Terms
-
medium 6.5 Accordion
-
medium 5.4 Edwiser Bridge
-
medium 6.5 iNET Webkit
-
medium 4.3 Media Library File Size
-
medium 5.3 WP Travel
-
medium 6.5 affects latest 1.1 ABG Rich Pins
-
medium 5.4 Cloudinary
-
medium 5.4 FluentBoards
-
medium 4.3 LifePress
-
medium 5.3 Ryviu
-
medium 4.3 Textmetrics
-
medium 6.5 ArtPlacer Widget
-
medium 5.3 Contact Form 7 GetResponse Extension
-
medium 5.3 ElementCamp
-
medium 6.5 Blockons
-
medium 4.3 GeoDirectory
-
medium 5.4 Monetag Official Plugin
-
medium 4.3 Fraud Prevention For WooCommerce and EDD
-
medium 4.3 Download After Email
-
medium 4.3 HD Quiz
-
medium 5.4 File Manager for Google Drive
-
medium 4.3 Materialis Companion
-
medium 5.3 Protección de datos
-
medium 5.4 Radio Player
-
medium 4.3 WP Term Order
-
medium 4.3 Automatic Featured Images from Videos
-
medium 4.3 Booter
-
high 7.5 affects latest 1.6.7 Omnipress
-
medium 4.3 SiteLock Security
-
medium 5.3 Web Push Notifications
-
medium 5.3 CLP Varnish Cache
-
medium 6.5 Nova Blocks by Pixelgrade
-
medium 5.3 affects latest 1.6.7 Quick Restaurant Reservations
-
medium 4.3 Tablesome Table
-
medium 5.3 WebP Conversion
-
medium 6.5 Email Inquiry & Cart Options for WooCommerce
-
medium 5.3 WP FullCalendar
-
medium 4.3 Kama Thumbnail
-
medium 4.3 affects latest 1.2.16 WP Subscribe
-
medium 4.3 weDocs
-
medium 6.4 WP DSGVO Tools (GDPR)
-
high 8.8 Melapress Role Editor
-
high 7.3 BuddyPress
-
medium 5.3 KiviCare
-
medium 6.4 WP RSS Aggregator
-
medium 6.4 Schema & Structured Data for WP & AMP
-
medium 6.4 Uncanny Automator
Thursday, January 22, 2026 · 122
-
medium 6.5 bSlider
-
medium 4.3 Element Invader
-
medium 5.4 Merge + Minify + Refresh
-
medium 6.5 Gallery PhotoBlocks
-
medium 4.3 WP Quick Post Duplicator
-
medium 4.3 WPMasterToolKit (WPMTK)
-
medium 4.3 BA Book Everything
-
medium 5.4 RegistrationMagic
-
medium 5.3 EventPrime
-
medium 4.3 Nexter Blocks
-
medium 6.5 WP Job Portal
-
medium 5.3 YITH Request a Quote for WooCommerce
-
medium 4.9 GetGenie
-
medium 6.5 LearnPress
-
medium 4.3 Quiz and Survey Master (QSM)
-
medium 4.4 Seriously Simple Podcasting
-
medium 5.4 Stock Manager for WooCommerce
-
medium 4.3 WP Recipe Maker
-
medium 5.9 Modula Image Gallery
-
medium 4.3 User Registration & Membership
-
medium 4.3 BD Courier Order Ratio Checker
-
medium 4.9 IMGspider
-
medium 5.4 teachPress
-
medium 4.3 affects latest 1.0.14 Absolute Addons For Elementor
-
medium 4.3 affects latest 1.4.5 Add Polylang support for Customizer
-
medium 4.3 Easy Form Builder by WhiteStudio
-
medium 6.5 affects latest 1.2.5 Form to Chat App ⚡️
-
high 7.6 affects latest 2.7.11 FireStorm Professional Real Estate Plugin
-
high 7.5 My auctions allegro
-
medium 4.3 WP MapIt
-
medium 5.3 affects latest 2.6.5.2 Apimo Connector
-
medium 5.3 Product Feed Manager for WooCommerce
-
medium 5.9 affects latest 2.2.2 Owl Carousel WP
-
medium 6.5 affects latest 3.3.2 Carousel Horizontal Posts Content Slider
-
medium 5.3 Civic Cookie Control
-
medium 6.5 Menu In Post
-
high 7.1 affects latest 1.3 Simple XML Sitemap
-
medium 6.5 teachPress
-
high 7.5 Beaver Builder Page Builder
-
high 7.1 JobWP
-
high 7.1 TableOn
-
medium 6.5 Simply Schedule Appointments
-
high 7.6 Broadstreet
-
medium 5.4 Premium Addons for Elementor
-
critical 9.1 Xpro Addons
-
high 7.1 affects latest 1.1.7 WP Test Email
-
medium 5.3 Fluent Forms
-
high 8.5 HappyAddons for Elementor
-
high 8.6 HDForms
-
high 7.1 affects latest 4.0.2 ShoutOut
-
medium 5.8 affects latest 1.5 Synergy Project Manager
-
medium 6.5 affects latest 1.2.4 WDV One Page Docs
-
high 8.5 APPExperts
-
high 7.1 affects latest 2.12.0 bidorbuy Store Integrator
-
high 7.1 Dinatur
-
high 7.1 affects latest 2.3.0 Dooodl
-
high 7.1 Infility Global
-
critical 9.8 LazyTasks
-
high 7.5 affects latest 1.1.5 Scalenut
-
high 7.1 affects latest 1.1 WP Simple Redirect
-
medium 6.5 Depicter
-
high 7.1 Easy Theme Options
-
critical 9.3 Paid Downloads
-
high 7.1 affects latest 7.1.1 Quote Master
-
high 7.1 ravpage
-
high 7.1 affects latest 3.0.83.3 Syntax Highlighter Compress
-
high 7.1 affects latest 1.07 wpCAS
-
medium 6.5 Icegram Engage
-
medium 6.5 GDPR CCPA Compliance & Cookie Consent Banner
-
high 7.1 Omnichannel for WooCommerce
-
medium 6.5 Easy Property Listings
-
medium 6.5 Lead Form Builder & Contact Form
-
medium 6.5 WP BackItUp Community Edition
-
high 8.8 Eventin
-
high 7.5 Antideo Email Validator
-
critical 9.3 CleverReach® WP
-
high 7.2 Frontis Blocks
-
high 7.3 Hydra Booking
-
medium 6.5 WANotifier for Forms and Actions
-
medium 6.5 SEO Booster
-
high 7.5 Tabby Checkout
-
critical 9.4 StackWC Order Notification for WooCommerce
-
high 7.1 CodeColorer
-
critical 9.0 Event Tickets with Ticket Scanner
-
high 7.1 GLS Shipping for WooCommerce
-
high 7.1 Netgsm
-
medium 6.5 onepay Payment Gateway For WooCommerce
-
medium 6.5 affects latest 1.0.3 Slider Templates
-
high 7.1 affects latest 1.3 WP Mail
-
medium 6.5 affects latest 1.1.23 Booking Ultra Pro Appointments Booking Calenda…
-
medium 6.5 Event Espresso
-
critical 10.0 g-FFL Checkout
-
high 7.1 affects latest 1.2.1.1 My Post Order
-
medium 6.5 affects latest 1.2.10 Shown Connector
-
medium 6.5 TaxCloud for WooCommerce
-
high 8.2 User Registration & Membership
-
medium 6.4 WPO365
-
high 8.1 Booking Activities
-
critical 9.1 Nelio A/B Testing
-
medium 6.5 Salon Booking System
-
critical 9.3 MailerLite
-
high 7.1 My auctions allegro
-
medium 6.5 Peach Payments Gateway
-
medium 6.5 Tickera
-
medium 4.3 Pretty Search Permalinks
-
medium 4.9 ANAC XML Viewer
-
medium 5.3 Cookies and Content Security Policy
-
medium 5.3 affects latest 3.1.0 Payment Gateway bKash for WC
-
medium 5.4 WP-CRM System
-
medium 5.9 affects latest 0.2 Affiliate Link Tracker
-
high 7.1 flexo-posts-manager
-
high 7.1 WordPress Photo Gallery
-
high 8.8 Jupiter X Core
-
medium 5.9 affects latest 1.1.8.4 Pondol BBS
-
medium 4.3 Element Pack Addons for Elementor
-
medium 5.9 Stackable
-
low 3.8 Tutor LMS
-
critical 9.8 LA-Studio Element Kit for Elementor
-
medium 5.3 Photo Gallery by 10Web
Wednesday, January 21, 2026 · 1
-
critical 9.8 Academy LMS
Tuesday, January 20, 2026 · 18
-
medium 6.4 FlatPM
-
medium 6.4 Head Meta Data
-
high 8.1 Nexter Extension
-
medium 4.3 NotificationX
-
medium 5.4 Tutor LMS
-
high 8.8 Creator LMS
-
high 7.2 NotificationX
-
medium 5.4 The Events Calendar
-
critical 9.8 Advanced Custom Fields
-
medium 4.4 Viet contact
-
medium 4.4 WP Hello Bar
-
high 8.1 Dokan
-
medium 5.3 weMail
-
medium 5.3 Custom Fonts
-
medium 5.3 LearnPress
-
medium 4.3 Newsletter
-
medium 5.3 PeachPay
-
medium 5.4 Image Photo Gallery Final Tiles Grid
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.