WordPress plugin vulnerabilities: week 7, 2026

95 vulnerabilities published Feb 9 – Feb 15, 2026 in 93 plugins we track, by day.

3 critical 19 high 73 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, February 15, 2026 · 3

• medium 6.5 Element Pack Addons for Elementor

  Path traversal / file read

  CVE-2026-1793 · affected 8.3.17 and older · fixed in 8.3.18 *

• high 8.8 Ecwid by Lightspeed Ecommerce Shopping Cart

  Privilege escalation

  CVE-2026-1750 · affected 7.0.7 and older · fixed in 7.0.8 *

• critical 9.8 Anti-Spam, Spam FireWall by CleanTalk

  Remote code execution

  CVE-2026-1490 · affected 6.71 and older · fixed in 6.71.1 *

Saturday, February 14, 2026 · 53

• medium 4.3 Media Library Folders

  Missing authorization check

  CVE-2026-2312 · affected 8.3.6 and older · fixed in 8.3.7 *

• medium 6.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-1512 · affected 6.5.9 and older · fixed in 6.5.10 *

• medium 4.9 Mail Mint

  SQL injection

  CVE-2026-1258 · affected 1.19.2 and older · fixed in 1.19.3 *

• medium 4.3 Modula Image Gallery

  Missing authorization check

  CVE-2026-1254 · affected 2.13.6 and older · fixed in 2.13.7 *

• high 7.2 Super Page Cache

  Stored cross-site scripting (XSS)

  CVE-2026-1843 · affected 5.2.2 and older · fixed in 5.2.3 *

• medium 5.0 MP3 Audio Player

  Server-side request forgery (SSRF)

  CVE-2026-1249 · affected 5.3 to 5.10 · fixed in 5.11 *

• medium 6.4 Points Management System For Gamification, Ran…

  Stored cross-site scripting (XSS)

  CVE-2026-0550 · affected 2.9.7.3 and older · fixed in 2.9.7.4 *

• high 7.5 PhotoStack Gallery

  SQL injection

  CVE-2026-2024 · affected 0.4.1 and older · fix not stated

• medium 5.3 CallbackKiller service widget

  Missing authorization check

  CVE-2026-1944 · affected 1.2 and older · fix not stated

• high 7.5 Flexi Product Slider and Grid for WooCommerce

  File inclusion

  CVE-2026-1988 · affected 1.0.5 and older · fix not stated

• medium 6.4 Press3D

  Stored cross-site scripting (XSS)

  CVE-2026-1985 · affected 1.0.2 and older · fixed in 1.1.0 *

• medium 5.4 Scheduler Widget

  Missing authorization check

  CVE-2026-1987 · affected 0.1.6 and older · fix not stated

• medium 4.3 Smart Forms

  Missing authorization check

  CVE-2026-2022 · affected 2.6.99 and older · fix not stated

• medium 6.4 Percent to Infograph

  Stored cross-site scripting (XSS)

  CVE-2026-1939 · affected 1.0 and older · fix not stated

• medium 6.4 QuestionPro Surveys

  Stored cross-site scripting (XSS)

  CVE-2026-1901 · affected 1.0 and older · fix not stated

• medium 6.4 Ravelry Designs Widget

  Stored cross-site scripting (XSS)

  CVE-2026-1903 · affected 1.0.0 and older · fix not stated

• medium 6.4 Simple Plyr

  Stored cross-site scripting (XSS)

  CVE-2026-1915 · affected 0.0.1 and older · fix not stated

• medium 6.4 Sphere Manager

  Stored cross-site scripting (XSS)

  CVE-2026-1905 · affected 1.0.2 and older · fix not stated

• medium 6.4 UpMenu

  Stored cross-site scripting (XSS)

  CVE-2026-1910 · affected 3.1 and older · fixed in 3.2 *

• medium 6.1 Address Bar Ads

  Reflected cross-site scripting (XSS)

  CVE-2026-1795 · affected 1.0.0 and older · fix not stated

• medium 6.1 Geo Widget

  Stored cross-site scripting (XSS)

  CVE-2026-1792 · affected 1.0 and older · fix not stated

• critical 9.8 midi-Synth

  Arbitrary file upload

  CVE-2026-1306 · affected 1.1.0 and older · fix not stated

• medium 6.1 StyleBidet

  Reflected cross-site scripting (XSS)

  CVE-2026-1796 · affected 1.0.0 and older · fix not stated

• medium 4.3 WP Quick Contact Us

  Cross-site request forgery (CSRF)

  CVE-2026-1394 · affected 1.0 and older · fix not stated

• medium 6.4 Best-wp-google-map

  Stored cross-site scripting (XSS)

  CVE-2026-1096 · affected 2.1 and older · fix not stated

• medium 5.3 MailChimp Campaigns

  Missing authorization check

  CVE-2026-1303 · affected 3.2.4 and older · fix not stated

• medium 6.4 Payment Page

  Stored cross-site scripting (XSS)

  CVE-2026-0751 · affected 1.4.6 and older · fixed in 1.4.7 *

• high 7.2 Super Simple Contact Form

  Reflected cross-site scripting (XSS)

  CVE-2026-0753 · affected 1.6.2 and older · fix not stated

• medium 6.4 ZoomifyWP Free

  Stored cross-site scripting (XSS)

  CVE-2026-1187 · affected 1.1 and older · fix not stated

• medium 5.5 User Language Switch

  Server-side request forgery (SSRF)

  CVE-2026-0745 · affected 1.6.10 and older · fix not stated

• medium 5.4 Accordion and Accordion Slider

  Missing authorization check

  CVE-2026-0727 · affected 1.4.5 and older · fix not stated

• medium 4.4 Allow HTML in Category Descriptions

  Stored cross-site scripting (XSS)

  CVE-2026-0693 · affected 1.2.4 and older · fixed in 1.2.5 *

• medium 6.4 Chatbot for WordPress by Collect.chat ⚡️

  Stored cross-site scripting (XSS)

  CVE-2026-0736 · affected 2.4.8 and older · fixed in 2.4.9 *

• medium 6.4 MasterStudy LMS WordPress Plugin

  Stored cross-site scripting (XSS)

  CVE-2026-0559 · affected 3.7.11 and older · fixed in 3.7.12 *

• medium 4.4 User Language Switch

  Stored cross-site scripting (XSS)

  CVE-2026-0735 · affected 1.6.10 and older · fix not stated

• medium 6.4 WP Data Access

  Stored cross-site scripting (XSS)

  CVE-2026-0557 · affected 5.5.63 and older · fixed in 5.5.64 *

• medium 4.4 Link Hopper

  Stored cross-site scripting (XSS)

  CVE-2025-15483 · affected 2.5 and older · fixed in 3.0 *

• medium 5.3 One to one user Chat by WPGuppy

  Missing authorization check

  CVE-2025-6792 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 4.3 Appointment Booking Plugin

  Cross-site request forgery (CSRF)

  CVE-2025-14873 · affected 5.2.5 and older · fixed in 5.2.6 *

• medium 4.3 MDirector Newsletter WordPress Plugin

  Cross-site request forgery (CSRF)

  CVE-2025-14852 · affected 4.5.8 and older · fixed in 4.5.10 *

• medium 5.3 Appointment Booking Calendar Plugin

  Missing authorization check

  CVE-2026-1932 · affected 1.0.2 and older · fix not stated

• medium 4.4 AMP Enhancer

  Stored cross-site scripting (XSS)

  CVE-2026-2027 · affected 1.0.49 and older · fix not stated

• high 8.1 Magic Login Mail or QR Code

  Privilege escalation

  CVE-2026-2144 · affected 2.05 and older · fixed in 2.06 *

• medium 4.3 SEATT

  Cross-site request forgery (CSRF)

  CVE-2026-1983 · affected 1.5.0 and older · fix not stated

• medium 6.4 Citations tools

  Stored cross-site scripting (XSS)

  CVE-2026-1912 · affected 0.3.2 and older · fix not stated

• medium 6.1 personal-authors-category

  Reflected cross-site scripting (XSS)

  CVE-2026-1754 · affected 0.3 and older · fix not stated

• medium 6.4 Simple Wp colorfull Accordion

  Stored cross-site scripting (XSS)

  CVE-2026-1904 · affected 1.0 and older · fix not stated

• medium 6.1 Easy Voice Mail

  Stored cross-site scripting (XSS)

  CVE-2026-1164 · affected 1.2.5 and older · fixed in 1.2.6 *

• high 7.5 BlueSnap Payment Gateway for WooCommerce

  Missing authorization check

  CVE-2026-0692 · affected 3.4.0 and older · fixed in 3.4.1 *

• medium 4.9 BFG Tools

  Path traversal / file read

  CVE-2025-13681 · affected 1.0.7 and older · fixed in 1.0.8 *

• medium 5.3 Easy Form Builder by WhiteStudio

  Missing authorization check

  CVE-2025-14067 · affected 3.9.3 and older · fixed in 3.9.4 *

• medium 5.3 StickEasy Protected Contact Form

  Information disclosure

  CVE-2025-13973 · affected 1.0.1 and older · fixed in 1.0.2 *

• medium 5.3 WP Last Modified Info

  Missing authorization check

  CVE-2025-14608 · affected 1.9.5 and older · fixed in 1.9.6 *

Friday, February 13, 2026 · 2

• high 7.2 PixelYourSite

  Stored cross-site scripting (XSS)

  CVE-2026-1841 · affected 11.2.0 and older · fixed in 11.2.0.1 *

• high 8.8 Starfish Review Generation & Marketing for Wor…

  Privilege escalation

  CVE-2025-15157 · affected 3.1.19 and older · fixed in 3.1.20 *

Thursday, February 12, 2026 · 6

• high 8.8 FastDup

  Missing authorization check

  CVE-2026-1104 · affected 2.7.1 and older · fixed in 2.7.2 *

• high 7.2 Secure Copy Content Protection and Content Loc…

  Stored cross-site scripting (XSS)

  CVE-2026-1320 · affected 4.9.8 and older · fixed in 4.9.9 *

• high 7.2 Customer Reviews for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-1316 · affected 5.97.0 and older · fixed in 5.98.0 *

• medium 6.5 Activity Log for WordPress

  Missing authorization check

  CVE-2026-1671 · affected 1.2.8 and older · fix not stated

• medium 4.8 Converter for Media

  Server-side request forgery (SSRF)

  CVE-2026-1356 · affected 6.5.1 and older · fixed in 6.5.2 *

• medium 5.3 Appointment Booking Plugin

  Missing authorization check

  CVE-2026-1537 · affected 5.2.6 and older · fixed in 5.2.7 *

Wednesday, February 11, 2026 · 23

• high 8.8 wpForo Forum

  PHP object injection

  CVE-2026-0910 · affected 2.4.13 and older · fixed in 2.4.14 *

• medium 5.3 WPZOOM Addons for Elementor

  Missing authorization check

  CVE-2026-2295 · affected 1.3.2 and older · fixed in 1.3.3 *

• medium 6.4 Slideshow Wp

  Stored cross-site scripting (XSS)

  CVE-2026-1885 · affected 1.1 and older · fix not stated

• medium 6.4 IDE Micro code-editor

  Stored cross-site scripting (XSS)

  CVE-2026-1827 · affected 1.0.0 and older · fix not stated

• medium 6.4 HTML Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2026-1809 · affected 1.1 and older · fix not stated

• medium 6.4 BuddyHolis ListSearch

  Stored cross-site scripting (XSS)

  CVE-2026-1853 · affected 1.1 and older · fix not stated

• medium 6.4 Microtango

  Stored cross-site scripting (XSS)

  CVE-2026-1821 · affected 0.9.29 and older · fixed in 0.9.30 *

• medium 5.3 WaMate Confirm

  Missing authorization check

  CVE-2026-1833 · affected 2.0.1 and older · fix not stated

• medium 6.4 OpenPOS Lite

  Stored cross-site scripting (XSS)

  CVE-2026-1826 · affected 3.0 and older · fixed in 3.1 *

• medium 4.4 Category Image

  Stored cross-site scripting (XSS)

  CVE-2026-0815 · affected 2.0 and older · fix not stated

• medium 4.3 Invoct

  Missing authorization check

  CVE-2026-1748 · affected 1.6 and older · fixed in 1.7 *

• high 8.8 Custom Block Builder

  Remote code execution

  CVE-2026-1560 · affected 4.2.0 and older · fixed in 4.2.1 *

• medium 4.3 MMA Call Tracking

  Cross-site request forgery (CSRF)

  CVE-2026-1215 · affected 2.3.15 and older · fix not stated

• medium 6.5 Twitter posts to Blog

  Missing authorization check

  CVE-2026-1786 · affected 1.11.25 and older · fix not stated

• medium 6.4 WDES Responsive Popup

  Stored cross-site scripting (XSS)

  CVE-2026-1804 · affected 1.3.6 and older · fix not stated

• high 7.2 iONE360 configurator

  Stored cross-site scripting (XSS)

  CVE-2025-15440 · affected 2.0.57 and older · fix not stated

• medium 4.4 WPlyr Media Block

  Stored cross-site scripting (XSS)

  CVE-2026-0724 · affected 1.3.0 and older · fix not stated

• critical 9.8 WPvivid

  Arbitrary file upload

  CVE-2026-1357 · affected 0.9.123 and older · fixed in 0.9.124 *

• medium 6.4 Orbisius Random Name Generator

  Stored cross-site scripting (XSS)

  CVE-2026-1893 · affected 1.0.2 and older · fixed in 1.0.3 *

• medium 6.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-1231 · affected 2.10.0.5 and older · fixed in 2.10.0.6 *

• medium 4.3 FooGallery Photo Gallery

  Missing authorization check

  CVE-2025-15524 · affected 3.1.9 and older · fixed in 3.1.36 *

• high 7.2 Lucky Wheel Giveaway

  Remote code execution

  CVE-2025-14541 · affected 1.0.22 and older · fix not stated

• medium 6.5 SlimStat Analytics

  SQL injection

  CVE-2025-13431 · affected 5.3.1 and older · fixed in 5.3.2 *

Tuesday, February 10, 2026 · 8

• high 7.5 Ninja Forms

  Information disclosure

  CVE-2026-2268 · affected 3.14.0 and older · fixed in 3.14.1 *

• high 7.2 Name Directory

  Stored cross-site scripting (XSS)

  CVE-2026-1866 · affected 1.32.0 and older · fixed in 1.32.1 *

• medium 6.4 The Events Calendar Shortcode & Block

  Stored cross-site scripting (XSS)

  CVE-2026-1922 · affected 3.1.2 and older · fixed in 3.1.3 *

• medium 5.4 Popup builder with Gamification, Multi-Step Po…

  Missing authorization check

  CVE-2025-14895 · affected 2.2.0 and older · fixed in 2.2.1 *

• medium 5.3 WCFM Marketplace

  Missing authorization check

  CVE-2026-1722 · affected 3.7.0 and older · fixed in 3.7.1 *

• medium 6.4 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2026-0996 · affected 6.1.14 and older · fixed in 6.1.15 *

• high 7.2 WCFM

  Privilege escalation

  CVE-2026-0845 · affected 6.7.24 and older · fixed in 6.7.25 *

• medium 4.3 WCFM Membership

  Missing authorization check

  CVE-2025-15147 · affected 2.11.8 and older · fixed in 2.11.9 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan