WordPress plugin vulnerabilities: week 15, 2026
224 vulnerabilities published Apr 6 – Apr 12, 2026 in 206 plugins we track, by day.
7 critical 23 high 193 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, April 11, 2026 · 10
-
high 7.1 wpForo Forum
-
medium 6.1 Optimole
-
medium 6.4 BlockArt Blocks
-
high 8.8 BuddyPress Groupblog
-
medium 6.4 Greenshift
-
medium 6.5 LifterLMS
-
high 7.2 Optimole
-
medium 5.0 UsersWP
-
medium 4.3 Tutor LMS
-
medium 5.4 Tutor LMS
Friday, April 10, 2026 · 11
-
medium 6.5 YITH WooCommerce Wishlist
Security issue
-
medium 6.5 YML for Yandex Market
-
medium 6.4 AddFunc Head & Footer Code
-
medium 5.3 Customer Reviews for WooCommerce
-
medium 4.3 Download Manager
-
high 7.5 Tutor LMS
-
medium 4.3 UsersWP
-
medium 4.3 Aruba HiSpeed Cache
-
medium 6.4 Webling
-
medium 5.4 WP-Optimize
Thursday, April 9, 2026 · 11
-
medium 6.4 List category posts
-
medium 5.3 Online Scheduling and Appointment Booking System
Security issue
-
medium 6.4 UsersWP
-
medium 6.4 Ultimate FAQ Accordion Plugin
-
critical 9.8 Quick Playground
-
medium 6.4 Download Manager
-
medium 6.4 OSM
-
medium 5.4 Ziggeo
-
medium 4.4 Experto Dashboard for WooCommerce
-
medium 4.3 MStore API
-
high 8.8 Vertex Addons for Elementor
Wednesday, April 8, 2026 · 180
-
medium 6.4 Post Blocks & Tools
-
medium 6.4 Extensions for Leaflet Map
-
high 8.1 MW WP Form
-
critical 9.8 ProSolution WP Client
-
medium 4.3 Vsourz Form Entries for Contact Form 7
-
medium 5.4 Vsourz Form Entries for Contact Form 7
-
medium 6.4 Page Builder
-
high 8.8 Advanced Members for ACF
-
medium 6.4 Beaver Builder Page Builder
-
high 7.5 WCAPF
-
medium 6.5 User Registration & Membership
-
medium 4.3 BEAR
-
medium 6.5 BEAR
-
medium 6.4 WP Visitor Statistics (Real Time Traffic)
-
medium 6.4 pdfl.io
-
medium 6.4 Robo Gallery
-
medium 6.4 PrivateContent Free
-
medium 5.3 AnyTrack Affiliate Link Manager
-
medium 5.3 Mailercloud
-
medium 5.3 Accept PayPal Payments using Contact Form 7
-
medium 5.3 The Tribal Plugin
-
medium 5.3 affects latest 1.1.0 Make My Trivia
-
medium 6.5 UiCore Elements
-
medium 5.3 AI Workflow Automation
-
medium 6.5 Animation Addons
-
medium 5.3 MAIO
-
medium 5.3 WowOptin
-
medium 5.3 affects latest 1.5.0 The Publisher Desk ads.txt
-
medium 6.5 affects latest 1.8.1 WPBITS Addons For Elementor Page Builder
-
medium 5.3 affects latest 5.2.4 ShopWP
-
medium 5.3 Author Avatars List/Block
-
medium 5.3 Cryptocurrency Donation Box
-
medium 5.9 FSM Custom Featured Image Caption
-
medium 5.4 Podigee for WordPress
-
medium 5.3 Simply Schedule Appointments
-
medium 5.3 BSK PDF Manager
-
medium 5.3 eShipper Commerce
-
medium 5.3 Rapid Car Check
-
medium 5.9 Garden Gnome Package
-
medium 5.3 linkPizza-Manager
-
medium 5.3 affects latest 10.0.10 The Moneytizer
-
medium 5.3 affects latest 1.3.9 WP Frontend Profile
-
medium 5.3 Pinpoint Booking System
-
medium 5.3 Court Reservation
-
medium 5.3 affects latest 1.1.1 Diet Calorie Calculator
-
medium 5.3 Download Manager
-
medium 5.3 affects latest 1.0.6 Book Previewer for Woocommerce
-
medium 6.5 affects latest 3.1.1 MK Google Directions
-
medium 5.3 iZooto
-
medium 5.9 affects latest 1.7.0 Korea SNS
-
medium 5.3 NitroPack
-
medium 5.3 ShipTime
-
medium 6.0 Visual Link Preview
-
high 7.1 Extra Fees for WooCommerce
-
medium 6.5 Hello Bar Popup Builder
-
medium 5.3 affects latest 1.0.2 Leadrebel
-
medium 5.3 affects latest 2.5.6 Product Price by Formula for WooCommerce
-
medium 6.5 affects latest 3.0.5 SEO Friendly Images
-
medium 5.3 TrueBooker
-
medium 5.3 iGMS Direct Booking
-
medium 5.3 affects latest 1.0.2 leadlovers forms
-
medium 5.3 Panda Pods Repeater Field
-
medium 6.5 affects latest 4.12.0 TotalPoll for Polls and Contests
-
medium 5.3 UnitechPay
-
medium 4.3 Video Conferencing with Zoom
-
medium 5.3 Razorpay for WooCommerce
-
medium 5.9 WP Simple HTML Sitemap
-
medium 6.5 Leaflet Map
-
medium 5.4 MP3 Audio Player
-
medium 5.3 Payment Plugins for PayPal WooCommerce
-
medium 5.3 WP Ultimate Review
-
medium 6.5 Livemesh Addons by Elementor
-
medium 5.9 affects latest 1.8.14 Qubely
-
medium 6.5 RPS Include Content
-
critical 9.6 affects latest 3.2 Theme Editor
-
medium 6.4 affects latest 4.1.0 Getty Images
-
medium 4.9 School Management System
-
critical 9.6 Appointment booking for Next 7 Days.
-
medium 5.3 Download Attachments
-
medium 5.9 Download Manager
-
medium 5.4 JW Player for WordPress
-
medium 5.4 Filter Plus
-
medium 5.3 iPOSpays Payment Gateway for WooCommerce
-
medium 5.3 Wava Payment Plugin
-
medium 5.3 WpXmas Snow
-
medium 5.3 BizReview
-
medium 4.3 DEPART
-
medium 5.9 MyBookTable Bookstore by Stormhill Media
-
medium 5.3 NM Gift Registry and Wishlist Lite
-
medium 5.3 Order Tracking
-
medium 5.3 affects latest 1.1 Super Custom Login
-
medium 5.3 12 Step Meeting List
-
medium 6.5 12 Step Meeting List
-
medium 5.3 Booktics
-
medium 4.3 Bus Ticket Booking with Seat Reservation
-
medium 5.3 RepairBuddy
-
medium 5.3 Instantio
-
medium 6.5 Custom Query Blocks
-
medium 4.3 DirectoryPress
-
medium 5.3 Revive.so
-
medium 5.3 Share This Image
-
medium 5.3 Sprout Invoices
-
medium 5.3 Sunshine Photo Cart
-
medium 4.3 Travelly
-
medium 5.3 WP Delicious
-
medium 5.9 Hydra Booking
-
medium 5.3 RSVP and Event Management
-
medium 5.3 Tourfic
-
medium 5.3 Display Eventbrite Events
-
medium 6.5 Blog Filter
-
medium 5.3 Directorist
-
medium 4.9 Nelio Content
-
medium 5.3 Nexter Blocks
-
medium 5.3 weDocs
-
medium 5.4 WpStream
-
medium 6.5 Advanced Coupons for WooCommerce
-
medium 5.4 InstaWP Connect
-
medium 5.3 Seriously Simple Podcasting
-
medium 6.5 Themesflat Addons For Elementor
-
medium 5.3 FOX
-
high 7.6 FOX
-
high 8.5 Download Monitor
-
medium 4.7 Hide My WP Ghost
-
high 8.5 Simply Schedule Appointments
-
medium 6.5 SureCart
-
high 7.6 YayMail
-
medium 4.3 CartFlows
-
medium 5.3 Simple History
-
high 7.6 OttoKit
-
medium 4.3 UserFeedback
-
high 7.6 UserFeedback
-
medium 6.5 VK All in One Expansion Unit
-
high 7.6 Broken Link Checker
-
medium 5.5 Website Builder by SeedProd
-
medium 4.3 Page Builder
-
medium 6.4 Magic Conversation For Gravity Forms
-
medium 5.3 Awesome Support
-
medium 6.4 Element Pack Addons for Elementor
-
medium 4.3 Blog2Social
-
medium 4.4 Inquiry form to posts or pages
-
medium 6.4 Wavr
-
medium 6.4 WowPress
-
medium 5.4 Attendance Manager
-
high 7.2 Gerador de Certificados
-
medium 5.3 Masteriyo LMS
-
medium 4.3 Quran Translations
-
medium 6.4 Sports Club Management
-
medium 6.4 Columns by BestWebSoft
-
critical 9.8 DSGVO Google Web Fonts GDPR
-
medium 5.3 PZ Frontend Manager
-
medium 5.3 Riaxe Product Customizer
-
medium 6.5 WP Blockade
-
medium 6.4 Site Verification Meta Tag
-
medium 4.4 Whole Enquiry Cart for WooCommerce
-
medium 5.4 AM LottiePlayer
-
medium 6.4 The Plus Addons for Elementor
-
medium 6.4 Prime Slider
-
medium 6.4 Appointment Booking Plugin
-
medium 6.4 LearnPress
-
medium 5.3 LTL Freight Quotes
-
medium 5.3 MainWP Child Reports
-
critical 9.8 Users manager
-
medium 6.4 Investi
-
medium 6.4 TableOn
-
medium 6.4 Strong Testimonials
-
medium 6.4 LightPress Lightbox
-
medium 6.4 PowerPress Podcasting plugin by Blubrry
-
critical 9.8 Everest Forms
-
medium 6.4 Elementor Website Builder
-
medium 5.4 Download Monitor
-
medium 5.3 Hustle
Tuesday, April 7, 2026 · 10
-
medium 5.4 Smart Slider 3
-
medium 5.3 Backup Migration
-
medium 5.3 LTL Freight Quotes
-
medium 5.4 Ocean Extra
-
high 7.5 Simple Social Media Share Buttons
-
medium 5.3 Charitable
Security issue
-
medium 6.5 Link Whisper Free
-
medium 6.5 SQL Chart Builder
Monday, April 6, 2026 · 2
-
medium 6.5 Media Library Assistant
-
high 8.5 Media Library Assistant
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.