WordPress plugin vulnerabilities: week 6, 2026

112 vulnerabilities published Feb 2 – Feb 8, 2026 in 101 plugins we track, by day.

2 critical 15 high 95 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, February 8, 2026 · 2

• high 8.8 JAY Login & Register

  Privilege escalation

  CVE-2025-15100 · affected 2.6.03 and older · fixed in 2.6.04 *

• critical 9.8 JAY Login & Register

  Privilege escalation

  CVE-2025-15027 · affected 2.6.03 and older · fixed in 2.6.04 *

Saturday, February 7, 2026 · 16

• medium 5.3 Advanced Country Blocker

  Security issue

  CVE-2026-1675 · affected 2.3.1 and older · fixed in 2.3.2 *

• medium 6.1 MP-Ukagaka

  Reflected cross-site scripting (XSS)

  CVE-2026-1643 · affected 1.5.2 and older · fix not stated

• medium 6.4 OMIGO

  Stored cross-site scripting (XSS)

  CVE-2026-1573 · affected 3.3 and older · fix not stated

• medium 6.4 Simple Bible Verse via Shortcode

  Stored cross-site scripting (XSS)

  CVE-2026-1570 · affected 1.1 and older · fix not stated

• medium 6.1 Subitem AL Slider

  Reflected cross-site scripting (XSS)

  CVE-2026-1634 · affected 1.0.0 and older · fix not stated

• medium 6.4 Video Onclick

  Stored cross-site scripting (XSS)

  CVE-2026-1608 · affected 0.4.7 and older · fix not stated

• medium 6.4 Wikiloops Track Player

  Stored cross-site scripting (XSS)

  CVE-2026-1611 · affected 1.0.1 and older · fix not stated

• medium 6.4 Wonka Slide

  Stored cross-site scripting (XSS)

  CVE-2026-1613 · affected 1.3.3 and older · fix not stated

• medium 6.4 Premmerce

  Stored cross-site scripting (XSS)

  CVE-2026-0555 · affected 1.3.20 and older · fixed in 1.3.21 *

• medium 6.5 The Bucketlister

  SQL injection

  CVE-2025-15477 · affected 0.1.5 and older · fix not stated

• medium 4.3 The Bucketlister

  Missing authorization check

  CVE-2025-15476 · affected 0.1.5 and older · fix not stated

• medium 4.3 TITLE ANIMATOR

  Cross-site request forgery (CSRF)

  CVE-2026-1082 · affected 1.0 and older · fix not stated

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2025-15267 · affected 5.6.1 and older · fixed in 5.6.9 *

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2025-13463 · affected 5.5.3 and older · fixed in 5.6.9 *

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2025-12803 · affected 5.5.1 and older · fixed in 5.6.9 *

• medium 6.4 Bold Page Builder

  Stored cross-site scripting (XSS)

  CVE-2025-12159 · affected 5.4.8 and older · fixed in 5.6.9 *

Friday, February 6, 2026 · 11

• medium 6.4 Yoast SEO

  Stored cross-site scripting (XSS)

  CVE-2026-1293 · affected 26.8 and older · fixed in 26.9 *

• medium 4.3 Code Snippets

  Cross-site request forgery (CSRF)

  CVE-2026-1785 · affected 3.9.4 and older · fixed in 3.9.5 *

• high 8.8 WP Duplicate

  Arbitrary file upload

  CVE-2026-1499 · affected 1.1.8 and older · fixed in 1.1.9 *

• medium 6.4 Events Listing Widget

  Stored cross-site scripting (XSS)

  CVE-2026-1252 · affected 1.3.4 and older · fixed in 1.3.5 *

• medium 6.4 Employee Directory

  Stored cross-site scripting (XSS)

  CVE-2026-1279 · affected 1.2.1 and older · fixed in 1.2.2 *

• medium 6.4 Docus

  Stored cross-site scripting (XSS)

  CVE-2026-1888 · affected 1.0.6 and older · fixed in 1.0.7 *

• medium 6.4 WaveSurfer-WP

  Stored cross-site scripting (XSS)

  CVE-2026-1909 · affected 2.8.3 and older · fixed in 2.8.4 *

• medium 6.4 Orange Comfort+ accessibility toolbar for Word…

  Stored cross-site scripting (XSS)

  CVE-2026-1808 · affected 0.7 and older · fixed in 0.7.1 *

• medium 6.4 Tune Library

  Stored cross-site scripting (XSS)

  CVE-2026-1401 · affected 1.6.3 and older · fixed in 1.6.4 *

• medium 5.3 OAuth Single Sign On

  Missing authorization check

  CVE-2025-10753 · affected 6.26.14 and older · fixed in 6.26.15 *

• medium 4.3 Timeline Block

  Missing authorization check

  CVE-2026-1228 · affected 1.3.3 and older · fixed in 1.3.4 *

Thursday, February 5, 2026 · 11

• medium 5.4 Greenshift

  Stored cross-site scripting (XSS)

  CVE-2026-1927 · affected 12.6 and older · fixed in 12.6.1 *

• high 7.2 All In One Image Viewer

  Server-side request forgery (SSRF)

  CVE-2026-1294 · affected 1.0.2 and older · fixed in 1.0.3 *

• medium 6.1 Peter’s Date Countdown

  Reflected cross-site scripting (XSS)

  CVE-2026-1654 · affected 2.0.0 and older · fix not stated

• medium 5.3 ProfileGrid

  Missing authorization check

  CVE-2026-1271 · affected 5.9.7.2 and older · fixed in 5.9.7.3 *

• medium 5.3 ELEX WordPress HelpDesk & Customer Ticketing S…

  Missing authorization check

  CVE-2025-14079 · affected 3.3.5 and older · fixed in 3.3.6 *

• medium 4.3 ProfileGrid

  Missing authorization check

  CVE-2025-13416 · affected 5.9.7.2 and older · fixed in 5.9.7.3 *

• medium 6.4 Robin Image Optimizer

  Stored cross-site scripting (XSS)

  CVE-2026-1319 · affected 2.0.2 and older · fixed in 2.0.3 *

• medium 6.4 Dynamic Widget Content

  Stored cross-site scripting (XSS)

  CVE-2026-1268 · affected 1.3.6 and older · fixed in 1.3.7 *

• medium 6.4 Essential Widgets

  Stored cross-site scripting (XSS)

  CVE-2026-0867 · affected 3.0 and older · fixed in 3.0.1 *

• medium 4.9 ShortPixel Image Optimizer

  Path traversal / file read

  CVE-2026-1246 · affected 6.4.2 and older · fixed in 6.4.3 *

• high 8.2 Popup builder with Gamification, Multi-Step Po…

  SQL injection

  CVE-2025-13192 · affected 2.2.0 and older · fixed in 2.2.1 *

Wednesday, February 4, 2026 · 17

• high 8.8 SportsPress

  File inclusion

  CVE-2025-15368 · affected 2.7.26 and older · fixed in 2.7.27 *

• medium 4.9 All push notification for WP

  SQL injection

  CVE-2026-0816 · affected 1.5.3 and older · fix not stated

• medium 4.4 Extended Random Number Generator

  Stored cross-site scripting (XSS)

  CVE-2026-0681 · affected 1.1 and older · fix not stated

• medium 5.3 Fortis for WooCommerce

  Missing authorization check

  CVE-2026-0679 · affected 1.2.0 and older · fixed in 1.3.0 *

• medium 4.9 SIBS woocommerce payment gateway

  SQL injection

  CVE-2026-1370 · affected 2.2.0 and older · fix not stated

• medium 6.4 Smart Appointment & Booking

  Stored cross-site scripting (XSS)

  CVE-2026-0742 · affected 1.0.7 and older · fixed in 1.0.8 *

• medium 4.4 WP Content Permission

  Stored cross-site scripting (XSS)

  CVE-2026-0743 · affected 1.2 and older · fix not stated

• medium 5.3 Chapa Payment Gateway Plugin for WooCommerce

  Information disclosure

  CVE-2025-15482 · affected 1.0.3 and older · fix not stated

• medium 4.9 Code Explorer

  Path traversal / file read

  CVE-2025-15487 · affected 1.4.6 and older · fix not stated

• medium 5.3 affects latest 1.0.6 Magic Import Document Extractor

  Information disclosure

  CVE-2025-15508 · affected 1.0.6 and older · no fix listed yet

• medium 5.3 Magic Import Document Extractor

  Missing authorization check

  CVE-2025-15507 · affected 1.0.5 and older · fixed in 1.0.6 *

• medium 6.5 WebPurify Profanity Filter

  Missing authorization check

  CVE-2026-0572 · affected 4.0.2 and older · fix not stated

• high 7.5 Infility Global

  SQL injection

  CVE-2025-15268 · affected 2.14.46 and older · fixed in 2.16.24 *

• high 7.5 SEO Flow by LupsOnline

  Missing authorization check

  CVE-2025-15285 · affected 2.2.1 and older · fixed in 3.0.0 *

• medium 6.5 MyRewards

  Missing authorization check

  CVE-2025-15260 · affected 5.6.1 and older · fixed in 5.7.0 *

• medium 5.3 Xendit Payment

  Missing authorization check

  CVE-2025-14461 · affected 6.0.2 and older · fixed in 6.1.0 *

• high 8.8 WP FOFT Loader

  Arbitrary file upload

  CVE-2026-1756 · affected 2.1.39 and older · fixed in 2.1.43 *

Tuesday, February 3, 2026 · 53

• medium 6.4 Menu Icons by Themeisle

  Stored cross-site scripting (XSS)

  CVE-2026-1755 · affected 0.13.20 and older · fixed in 0.13.21 *

• medium 6.5 Passster

  Missing authorization check

  CVE-2026-25036 · affected 4.2.25 and older · fixed in 4.2.26

• medium 5.4 ElementInvader Addons for Elementor

  Missing authorization check

  CVE-2026-25028 · affected 1.4.1 and older · fixed in 1.4.2

• medium 5.3 Atarim

  Missing authorization check

  CVE-2026-25019 · affected 4.3.1 and older · fixed in 4.3.2

• medium 5.3 Run Contests, Raffles, and Giveaways with Cont…

  Information disclosure

  CVE-2026-25023 · affected 2.0.7 and older · fixed in 2.1.1

• high 8.5 KiviCare

  SQL injection

  CVE-2026-25022 · affected 3.6.16 and older · fixed in 4.0.0

• medium 5.4 Mizan Demo Importer

  Missing authorization check

  CVE-2026-25021 · affected 0.1.3 and older · fixed in 0.1.4

• medium 5.4 ThirstyAffiliates

  Cross-site request forgery (CSRF)

  CVE-2026-25024 · affected 3.11.9 and older · fixed in 3.11.10

• medium 4.3 WP Sync for Notion

  Missing authorization check

  CVE-2026-25020 · affected 1.7.0 and older · fixed in 1.7.1

• medium 4.3 Enter Addons

  Cross-site request forgery (CSRF)

  CVE-2026-25014 · affected 2.3.2 and older · fixed in 2.3.3

• medium 4.3 Nelio Popups

  Missing authorization check

  CVE-2026-25016 · affected 1.3.5 and older · fixed in 1.3.6

• medium 5.3 Share This Image

  Missing authorization check

  CVE-2026-25010 · affected 2.09 and older · fixed in 2.10

• medium 4.3 UsersWP

  Cross-site request forgery (CSRF)

  CVE-2026-25015 · affected 1.2.53 and older · fixed in 1.2.54

• medium 5.3 Hustle

  Information disclosure

  CVE-2026-24998 · affected 7.8.9.2 and older · fixed in 7.8.9.3

• medium 5.3 WP Bannerize Pro

  Missing authorization check

  CVE-2026-25012 · affected 1.11.0 and older · fixed in 1.11.1

• medium 4.3 WP Custom Admin Interface

  Missing authorization check

  CVE-2026-25011 · affected 7.41 and older · fixed in 7.42

• medium 5.3 Extensions For CF7 (Contact form 7 Database, C…

  Missing authorization check

  CVE-2026-24991 · affected 3.4.0 and older · fixed in 3.4.1

• medium 4.3 Latest Post Shortcode

  Missing authorization check

  CVE-2026-24995 · affected 14.2.0 and older · fixed in 14.2.1

• medium 5.3 Sunshine Photo Cart

  Missing authorization check

  CVE-2026-24994 · affected 3.5.7.2 and older · fixed in 3.5.7.3

• medium 5.3 Advanced Reporting and Statistics for WooComme…

  Information disclosure

  CVE-2026-24992 · affected 4.1.2 and older · fixed in 4.1.3

• medium 5.3 Wired Impact Volunteer Management

  Missing authorization check

  CVE-2026-24997 · affected 2.8 and older · fixed in 2.8.1

• medium 5.4 WP Docs

  Missing authorization check

  CVE-2026-24990 · affected 2.2.8 and older · fixed in 2.2.9

• medium 4.3 WPElemento Importer

  Missing authorization check

  CVE-2026-24996 · affected 0.6.4 and older · fixed in 0.6.5

• medium 5.3 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-24967 · affected 1.2.38 and older · fixed in 2.0

• medium 4.3 Copyscape Premium

  Cross-site request forgery (CSRF)

  CVE-2026-24966 · affected 1.4.1 and older · fixed in 1.4.2

• medium 5.4 Simple Membership WP user Import

  Cross-site request forgery (CSRF)

  CVE-2026-24986 · affected 1.9.1 and older · fixed in 1.9.2

• medium 6.5 The Events Calendar Shortcode & Block

  Stored cross-site scripting (XSS)

  CVE-2026-24988 · affected 3.1.1 and older · fixed in 3.1.2

• medium 5.3 Spectra Legacy

  Missing authorization check

  CVE-2026-24982 · affected 2.19.17 and older · fixed in 2.19.18

• medium 6.5 Visual Link Preview

  Missing authorization check

  CVE-2026-24984 · affected 2.2.9 and older · fixed in 2.3.0

• medium 4.3 WP Forms Signature Contract Add-On

  Missing authorization check

  CVE-2026-24985 · affected 1.8.2 and older · fixed in 1.8.3

• medium 4.3 Contest Gallery

  Missing authorization check

  CVE-2026-24965 · affected 28.1.1 and older · fixed in 28.1.2

• high 8.8 Event Booking Manager for WooCommerce

  PHP object injection

  CVE-2026-24954 · affected 5.0.8 and older · fixed in 5.0.9

• medium 4.3 Points Management System For Gamification, Ran…

  Missing authorization check

  CVE-2026-24951 · affected 2.9.7.3 and older · fixed in 2.9.7.4

• medium 6.5 Seriously Simple Podcasting

  Stored cross-site scripting (XSS)

  CVE-2026-24952 · affected 3.14.1 and older · fixed in 3.14.2

• medium 4.3 Sigmize

  Cross-site request forgery (CSRF)

  CVE-2026-24962 · affected 0.0.9 and older · fixed in 0.0.10

• medium 6.5 Strong Testimonials

  Missing authorization check

  CVE-2026-24957 · affected 3.2.20 and older · fixed in 3.2.21

• medium 5.9 Better Search

  Stored cross-site scripting (XSS)

  CVE-2026-24938 · affected 4.2.1 and older · fixed in 4.2.2

• medium 4.3 LA-Studio Element Kit for Elementor

  Missing authorization check

  CVE-2026-24947 · affected 1.5.6.3 and older · fixed in 1.5.6.3

• medium 4.3 Event Booking Manager for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2026-24942 · affected 5.1.1 and older · fixed in 5.1.2

• medium 4.3 Modula Image Gallery

  Missing authorization check

  CVE-2026-24939 · affected 2.13.6 and older · fixed in 2.13.7

• medium 4.3 Tourfic Toolkit

  Missing authorization check

  CVE-2026-24940 · affected 1.3.3 and older · fixed in 1.3.4

• medium 5.3 Ultra Addons for Contact Form 7

  Missing authorization check

  CVE-2026-24945 · affected 3.5.34 and older · fixed in 3.5.35

• high 8.8 OS DataHub Maps

  Arbitrary file upload

  CVE-2026-1730 · affected 1.8.3 and older · fixed in 1.8.4 *

• high 8.1 Tutor LMS

  Missing authorization check

  CVE-2026-1375 · affected 3.9.5 and older · fixed in 3.9.6 *

• medium 5.3 Tutor LMS

  Missing authorization check

  CVE-2026-1371 · affected 3.9.5 and older · fixed in 3.9.6 *

• medium 6.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-1210 · affected 3.20.7 and older · fixed in 3.20.8 *

• medium 5.4 Mail Mint

  Cross-site request forgery (CSRF)

  CVE-2026-1447 · affected 1.19.2 and older · fixed in 1.19.3 *

• high 7.2 Form Maker by 10Web

  Stored cross-site scripting (XSS)

  CVE-2026-1065 · affected 1.15.35 and older · fixed in 1.15.36 *

• high 7.1 Form Maker by 10Web

  Stored cross-site scripting (XSS)

  CVE-2026-1058 · affected 1.15.35 and older · fixed in 1.15.36 *

• high 7.2 Appointment Booking Plugin

  Stored cross-site scripting (XSS)

  CVE-2026-0617 · affected 5.2.5 and older · fixed in 5.2.6 *

• medium 5.3 Spectra Legacy

  Information disclosure

  CVE-2026-0950 · affected 2.19.17 and older · fixed in 2.19.18 *

• medium 5.4 Unlimited Elements for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-14274 · affected 2.0.1 and older · fixed in 2.0.21 *

• medium 5.3 WP ULike

  Missing authorization check

  CVE-2026-0909 · affected 4.8.3.1 and older · fixed in 5.0.0 *

Monday, February 2, 2026 · 2

• medium 4.3 Five Star Restaurant Reservations

  Cross-site request forgery (CSRF)

  CVE-2026-0658 · affected older than 2.7.9 · fixed in 2.7.9

• critical 9.8 User Profile Builder

  Privilege escalation

  CVE-2025-15030 · affected 1.1.27 up to (not including) 3.15.2 · fixed in 3.15.2

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan