WordPress plugin vulnerabilities: week 9, 2026

44 vulnerabilities published Feb 23 – Mar 1, 2026 in 33 plugins we track, by day.

1 critical 12 high 31 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, February 28, 2026 · 11

• critical 9.8 wpForo Forum

  SQL injection

  CVE-2026-28562 · affected 2.4 up to (not including) 2.4.15 · fixed in 2.4.15

• medium 4.8 wpForo Forum

  Stored cross-site scripting (XSS)

  CVE-2026-28561 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 4.8 wpForo Forum

  Stored cross-site scripting (XSS)

  CVE-2026-28560 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 5.3 wpForo Forum

  Information disclosure

  CVE-2026-28559 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 5.4 wpForo Forum

  Stored cross-site scripting (XSS)

  CVE-2026-28558 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 6.5 wpForo Forum

  Missing authorization check

  CVE-2026-28557 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 5.4 wpForo Forum

  Missing authorization check

  CVE-2026-28556 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 4.3 wpForo Forum

  Missing authorization check

  CVE-2026-28555 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• medium 4.3 wpForo Forum

  Missing authorization check

  CVE-2026-28554 · affected 2.4 up to (not including) 2.4.16 · fixed in 2.4.16

• high 7.5 Tutor LMS

  SQL injection

  CVE-2025-13673 · affected 3.9.6 and older · fixed in 3.9.7 *

• high 7.5 WP Mail Logging

  PHP object injection

  CVE-2026-2471 · affected 1.15.0 and older · fixed in 1.16.0 *

Friday, February 27, 2026 · 8

• medium 4.9 MailArchiver

  SQL injection

  CVE-2026-2831 · affected 4.5.0 and older · fixed in 4.5.1 *

• medium 6.4 Electric Enquiries

  Stored cross-site scripting (XSS)

  CVE-2025-14142 · affected 1.1 and older · fix not stated

• medium 5.3 Japanized for WooCommerce

  Authentication bypass

  CVE-2026-1305 · affected 2.8.4 and older · fixed in 2.8.5 *

• medium 6.5 OVRI Payment

  Security issue

  CVE-2024-10938 · affected 1.7.0 only · fix not stated

• medium 6.4 Simple Download Monitor

  Stored cross-site scripting (XSS)

  CVE-2026-2383 · affected 4.0.5 and older · fixed in 4.0.6 *

• medium 6.4 WP Accessibility

  DOM-based cross-site scripting (XSS)

  CVE-2026-2362 · affected 2.3.1 and older · fixed in 2.3.4 *

• medium 6.4 Xpro Addons

  Stored cross-site scripting (XSS)

  CVE-2025-14149 · affected 1.4.24 and older · fix not stated

• medium 5.3 WP Recipe Maker

  Missing authorization check

  CVE-2026-1558 · affected 10.3.2 and older · fixed in 10.3.3 *

Thursday, February 26, 2026 · 13

• high 8.8 User Frontend

  Arbitrary file upload

  CVE-2026-1565 · affected 4.2.8 and older · fixed in 4.2.9 *

• medium 6.5 Addon Elements for Elementor (formerly Element…

  Information disclosure

  CVE-2026-28131 · affected 1.14.4 and older · fixed in 1.14.5

• high 7.2 affects latest 2.2.0 Directory Listings WordPress plugin

  PHP object injection

  CVE-2026-28138 · affected 2.2.0 and older · no fix listed yet

• high 7.6 WSMS (formerly WP SMS)

  SQL injection

  CVE-2026-28136 · affected 6.9.12 and older · fixed in 7.0

• high 8.8 Worry Proof Backup

  Remote code execution

  CVE-2026-1311 · affected 0.2.4 and older · fix not stated

• medium 5.3 User Registration & Membership

  Missing authorization check

  CVE-2026-2356 · affected 5.1.2 and older · fixed in 5.1.3 *

• high 8.1 User Registration & Membership

  Authentication bypass

  CVE-2026-1779 · affected 5.1.2 and older · fixed in 5.1.3 *

• medium 6.1 EM Cost Calculator

  Stored cross-site scripting (XSS)

  CVE-2026-2506 · affected 2.3.1 and older · fix not stated

• medium 4.4 Custom Logo

  Stored cross-site scripting (XSS)

  CVE-2026-2499 · affected 2.2 and older · fix not stated

• medium 4.4 WP Social Meta

  Stored cross-site scripting (XSS)

  CVE-2026-2498 · affected 1.0.1 and older · fix not stated

• medium 6.4 Livemesh Addons for Beaver Builder

  Stored cross-site scripting (XSS)

  CVE-2026-2029 · affected 3.9.2 and older · fix not stated

• medium 4.4 TP2WP Importer

  Stored cross-site scripting (XSS)

  CVE-2026-2489 · affected 1.1 and older · fix not stated

• high 7.5 WP Responsive Images

  Path traversal / file read

  CVE-2026-1557 · affected 1.0 and older · fix not stated

Wednesday, February 25, 2026 · 10

• medium 5.4 The Events Calendar

  Missing authorization check

  CVE-2026-2694 · affected 6.15.16 and older · fixed in 6.15.16.1 *

• medium 4.3 Disable Admin Notices

  Cross-site request forgery (CSRF)

  CVE-2026-2410 · affected 1.4.2 and older · fixed in 1.4.3 *

• medium 4.3 Post Duplicator

  Missing authorization check

  CVE-2026-2301 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 6.4 Secure Copy Content Protection and Content Loc…

  Stored cross-site scripting (XSS)

  CVE-2026-2367 · affected 5.0.1 and older · fixed in 5.0.2 *

• medium 4.3 WP Recipe Maker

  Missing authorization check

  CVE-2025-14742 · affected 10.2.3 and older · fixed in 10.2.4 *

• high 8.8 Advanced Woo Labels

  Remote code execution

  CVE-2026-1929 · affected 2.36 and older · fixed in 2.37 *

• high 7.5 Geo Mashup

  SQL injection

  CVE-2026-2416 · affected 1.13.17 and older · fixed in 1.13.18 *

• medium 5.0 Responsive Lightbox & Gallery

  Server-side request forgery (SSRF)

  CVE-2026-2479 · affected 2.7.1 and older · fixed in 2.7.2 *

• high 7.5 WPGSI

  Missing authorization check

  CVE-2026-1916 · affected 3.8.3 and older · fixed in 3.8.4 *

• medium 6.4 Rise Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-1614 · affected 3.7 and older · fix not stated

Tuesday, February 24, 2026 · 1

• high 8.8 Responsive Lightbox & Gallery

  Cross-site scripting (XSS)

  CVE-2025-15386 · affected 1.7.0 up to (not including) 2.6.1 · fixed in 2.6.1

Monday, February 23, 2026 · 1

• medium 5.3 Simple Ajax Chat

  Information disclosure

  CVE-2026-3075 · affected 20251121 and older · fixed in 20260217

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan