WordPress plugin vulnerabilities: week 14, 2026

43 vulnerabilities published Mar 30 – Apr 5, 2026 in 39 plugins we track, by day.

2 critical 13 high 28 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, April 4, 2026 · 19

• high 7.2 Visitor Traffic Real Time Statistics

  Stored cross-site scripting (XSS)

  CVE-2026-2936 · affected 8.4 and older · fixed in 8.5 *

• medium 6.5 ProfilePress

  Remote code execution

  CVE-2026-3309 · affected 4.16.11 and older · fixed in 4.16.12 *

• high 8.8 wpForo Forum

  Arbitrary file deletion

  CVE-2026-3666 · affected 2.4.16 and older · fixed in 2.4.17 *

• high 7.5 Text to Speech

  Information disclosure

  CVE-2026-1233 · affected 1.9.8 and older · fixed in 1.9.9 *

• medium 6.4 WPFunnels

  Stored cross-site scripting (XSS)

  CVE-2026-0626 · affected 3.7.9 and older · fixed in 3.8.0 *

• medium 4.3 Kadence Blocks

  Missing authorization check

  CVE-2026-2826 · affected 3.6.3 and older · fixed in 3.6.4 *

• high 7.2 Widgets for Social Photo Feed

  Stored cross-site scripting (XSS)

  CVE-2026-5425 · affected 1.7.9 and older · fixed in 1.8.2 *

• medium 6.4 WP Travel Engine

  Stored cross-site scripting (XSS)

  CVE-2026-2437 · affected 6.7.5 and older · fixed in 6.7.6 *

• high 7.1 ProfilePress

  Missing authorization check

  CVE-2026-3445 · affected 4.16.11 and older · fixed in 4.16.12 *

• medium 6.4 ElementsKit Elementor Addons

  Stored cross-site scripting (XSS)

  CVE-2026-2600 · affected 3.7.9 and older · fixed in 3.8.0 *

• medium 6.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2026-0737 · affected 7.4.7 and older · fixed in 7.4.8 *

• high 8.1 WCFM

  Missing authorization check

  CVE-2026-4896 · affected 6.7.25 and older · fixed in 6.7.26 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-0664 · affected 1.7.1049 and older · fixed in 1.7.1050 *

• medium 6.4 Ultimate Member

  Stored cross-site scripting (XSS)

  CVE-2025-15064 · affected 2.11.1 and older · fixed in 2.11.2 *

• medium 6.4 Simple Shopping Cart

  Stored cross-site scripting (XSS)

  CVE-2026-0552 · affected 5.2.4 and older · fixed in 5.2.5 *

• medium 6.4 Xpro Addons

  Stored cross-site scripting (XSS)

  CVE-2025-13368 · affected 1.4.20 and older · fix not stated

• medium 6.4 Xpro Addons

  Stored cross-site scripting (XSS)

  CVE-2026-2949 · affected 1.4.24 and older · fix not stated

• medium 6.4 Gutenverse

  Stored cross-site scripting (XSS)

  CVE-2026-2924 · affected 3.4.6 and older · fixed in 3.4.7 *

• medium 6.5 Pie Register

  Missing authorization check

  CVE-2026-3571 · affected 3.8.4.8 and older · fixed in 3.8.4.9 *

Thursday, April 2, 2026 · 6

• medium 6.5 MSTW League Manager

  Cross-site scripting (XSS)

  CVE-2026-34890 · affected 2.10 and older · fix not stated

• high 7.5 W3 Total Cache

  Remote code execution

  CVE-2026-5032 · affected 2.9.3 and older · fixed in 2.9.4-beta.1 *

• medium 6.4 Webmention

  Server-side request forgery (SSRF)

  CVE-2026-0688 · affected 5.6.2 and older · fixed in 5.7.0 *

• high 7.2 Webmention

  Server-side request forgery (SSRF)

  CVE-2026-0686 · affected 5.6.2 and older · fixed in 5.7.0 *

• high 8.1 MW WP Form

  Remote code execution

  CVE-2026-4347 · affected 5.1.0 and older · fixed in 5.1.1 *

• high 7.2 Spam Protect for Contact Form 7

  Remote code execution

  CVE-2026-1540 · affected older than 1.2.10 · fixed in 1.2.10

Wednesday, April 1, 2026 · 3

• medium 6.4 King Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2025-13535 · affected 51.1.53 and older · fixed in 51.1.54 *

• medium 4.3 Database for Contact Form 7, WPforms, Elemento…

  Missing authorization check

  CVE-2026-3831 · affected 1.4.9 and older · fixed in 1.5.0 *

• medium 6.5 Booking for Appointments and Events Calendar

  SQL injection

  CVE-2026-4668 · affected 2.1.2 and older · fixed in 2.1.3 *

Tuesday, March 31, 2026 · 12

• medium 6.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2026-2480 · affected 7.4.10 and older · fixed in 7.5.0 *

• medium 5.4 Minify HTML

  Cross-site request forgery (CSRF)

  CVE-2026-3191 · affected 2.1.12 and older · fixed in 2.1.13 *

• medium 4.3 User Profile Builder

  Missing authorization check

  CVE-2026-3139 · affected 3.15.5 and older · fixed in 3.15.6 *

• high 7.2 Query Monitor

  Reflected cross-site scripting (XSS)

  CVE-2026-4267 · affected 3.20.3 and older · fixed in 3.20.4 *

• medium 6.5 Kubio AI Page Builder

  Stored cross-site scripting (XSS)

  CVE-2026-34887 · affected 2.7.0 and older · fixed in 2.7.1

• medium 5.8 Performance Monitor

  Server-side request forgery (SSRF)

  CVE-2026-3881 · affected 1.0.6 and older · fix not stated

• medium 6.1 Auto Post Scheduler

  Cross-site request forgery (CSRF)

  CVE-2026-1877 · affected 1.84 and older · fix not stated

• medium 6.4 Ibtana

  Stored cross-site scripting (XSS)

  CVE-2026-1834 · affected 1.2.5.7 and older · fixed in 1.2.5.8 *

• medium 6.1 Loco Translate

  Reflected cross-site scripting (XSS)

  CVE-2026-4146 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 5.3 TrueBooker

  Information disclosure

  CVE-2026-1797 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 6.5 WooPayments

  Missing authorization check

  CVE-2026-1710 · affected 10.5.1 and older · fixed in 10.6.0 *

• critical 9.8 Everest Forms

  Remote code execution

  CVE-2026-3300 · affected 1.9.12 and older · fixed in 2.0.0 *

Monday, March 30, 2026 · 3

• high 8.8 Debugger & Troubleshooter

  Privilege escalation

  CVE-2026-5130 · affected 1.3.2 and older · fixed in 1.4.0 *

• critical 9.8 Contact Form by Supsystic

  Remote code execution

  CVE-2026-4257 · affected 1.7.36 and older · fixed in 1.8.0 *

• high 7.5 Download Monitor

  Missing authorization check

  CVE-2026-3124 · affected 5.1.7 and older · fixed in 5.1.8 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan