WordPress plugin vulnerabilities: week 16, 2026

106 vulnerabilities published Apr 13 – Apr 19, 2026 in 94 plugins we track, by day.

4 critical 28 high 73 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, April 19, 2026 · 1

• medium 6.4 EMC

  Stored cross-site scripting (XSS)

  CVE-2026-0868 · affected 4.4 and older · fixed in 4.5 *

Saturday, April 18, 2026 · 9

• medium 6.4 Contextual Related Posts

  Stored cross-site scripting (XSS)

  CVE-2026-2986 · affected 4.2.1 and older · fixed in 4.2.2 *

• medium 5.4 Categories Images

  Stored cross-site scripting (XSS)

  CVE-2026-2505 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 6.4 Content Blocks (Custom Post Widget)

  Stored cross-site scripting (XSS)

  CVE-2026-0894 · affected 3.3.9 and older · fixed in 3.4.1 *

• high 8.8 CMP

  Arbitrary file upload

  CVE-2026-6518 · affected 4.1.16 and older · fixed in 4.1.17 *

• medium 6.4 Flipbox Addon for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-6048 · affected 2.0.8 and older · fixed in 2.1.0 *

• medium 6.4 Page Builder Gutenberg Blocks

  Stored cross-site scripting (XSS)

  CVE-2026-4801 · affected 3.1.16 and older · fixed in 3.1.17 *

• medium 6.1 Hostel

  Reflected cross-site scripting (XSS)

  CVE-2026-1838 · affected 1.1.6 and older · fixed in 1.1.7 *

• medium 6.4 Youzify

  Stored cross-site scripting (XSS)

  CVE-2026-1559 · affected 1.3.6 and older · fixed in 1.3.7 *

• high 7.5 Easy Appointments

  Information disclosure

  CVE-2026-2262 · affected 3.12.21 and older · fixed in 3.12.22 *

Friday, April 17, 2026 · 20

• medium 6.4 Pz-LinkCard

  Stored cross-site scripting (XSS)

  CVE-2026-2434 · affected 2.5.8.1 and older · fixed in 2.5.9 *

• high 8.1 Drag and Drop Multiple File Upload for Contact…

  Arbitrary file upload

  CVE-2026-5718 · affected 1.3.9.7 and older · fixed in 1.3.9.8 *

• high 7.5 Drag and Drop Multiple File Upload for Contact…

  Path traversal / file read

  CVE-2026-5710 · affected 1.3.9.6 and older · fixed in 1.3.9.7 *

• high 8.8 WP Customer Area

  Remote code execution

  CVE-2026-3464 · affected 8.3.4 and older · fixed in 8.3.5 *

• medium 4.4 VideoZen

  Stored cross-site scripting (XSS)

  CVE-2026-6439 · affected 1.0.1 and older · fix not stated

• medium 4.3 Plugin

  Cross-site request forgery (CSRF)

  CVE-2026-6451 · affected 1.0.0 and older · fix not stated

• medium 4.3 Canto

  Missing authorization check

  CVE-2026-6441 · affected 3.1.1 and older · fixed in 3.1.4 *

• high 7.5 Unlimited Elements for Elementor

  Path traversal / file read

  CVE-2026-4659 · affected 2.0.6 and older · fixed in 2.0.21 *

• medium 5.3 Quiz and Survey Master (QSM)

  Missing authorization check

  CVE-2026-5797 · affected 10.1.0 and older · fixed in 10.1.1 *

• medium 6.5 Tutor LMS

  SQL injection

  CVE-2026-6080 · affected 3.9.8 and older · fixed in 3.9.9 *

• medium 5.3 Tutor LMS

  Cross-site request forgery (CSRF)

  CVE-2026-5502 · affected 3.9.8 and older · fixed in 3.9.9 *

• medium 4.9 JetBackup

  Path traversal / file read

  CVE-2026-4853 · affected 3.1.19.8 and older · fixed in 3.1.20.3 *

• medium 4.9 Form Maker by 10Web

  Cross-site request forgery (CSRF)

  CVE-2026-3330 · affected 1.15.40 and older · fixed in 1.15.41 *

• medium 5.3 Kubio AI Page Builder

  Arbitrary file upload

  CVE-2026-5427 · affected 2.7.2 and older · fixed in 2.7.3 *

• medium 5.3 Appointment Booking Plugin

  Missing authorization check

  CVE-2026-5234 · affected 5.3.2 and older · fixed in 5.4.0 *

• medium 6.5 wpForo Forum

  Missing authorization check

  CVE-2026-4666 · affected 2.4.16 and older · fixed in 2.4.17 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-5162 · affected 1.7.1056 and older · fixed in 1.7.1057 *

• high 7.2 WP Statistics

  Stored cross-site scripting (XSS)

  CVE-2026-5231 · affected 14.16.4 and older · fixed in 14.16.5 *

• medium 6.5 MasterStudy LMS WordPress Plugin

  SQL injection

  CVE-2026-4817 · affected 3.7.25 and older · fixed in 3.7.26 *

• medium 6.5 WP Statistics

  Missing authorization check

  CVE-2026-3488 · affected 14.16.4 and older · fixed in 14.16.5 *

Thursday, April 16, 2026 · 26

• medium 6.4 Email Encoder

  Stored cross-site scripting (XSS)

  CVE-2026-2840 · affected 2.4.4 and older · fixed in 2.4.5 *

• medium 5.3 Fluent Forms

  Missing authorization check

  CVE-2026-4160 · affected 6.1.21 only · fixed in 6.2.0 *

• high 7.5 DirectoryPress

  SQL injection

  CVE-2026-3489 · affected 3.6.26 and older · fixed in 3.6.27 *

• medium 5.4 Better Find and Replace

  Stored cross-site scripting (XSS)

  CVE-2026-3369 · affected 1.7.9 and older · fixed in 1.8.0 *

• low 3.1 OneSignal

  Missing authorization check

  CVE-2026-3155 · affected 3.8.0 and older · fixed in 3.8.1 *

• medium 5.3 Post Grid Blocks & Templates for News, Magazin…

  Missing authorization check

  CVE-2026-0718 · affected 5.0.5 and older · fix not stated

• high 8.8 Career Section

  Cross-site request forgery (CSRF)

  CVE-2025-14868 · affected 1.6 and older · fixed in 1.7 *

• medium 6.4 BetterDocs

  Stored cross-site scripting (XSS)

  CVE-2026-3875 · affected 4.3.8 and older · fixed in 4.3.9 *

• medium 4.4 OPEN-BRAIN

  Stored cross-site scripting (XSS)

  CVE-2026-3995 · affected 0.5.0 and older · fix not stated

• high 7.2 Prismatic

  Stored cross-site scripting (XSS)

  CVE-2026-3876 · affected 3.7.3 and older · fix not stated

• high 8.8 Livemesh Addons by Elementor

  File inclusion

  CVE-2026-1620 · affected 9.0 and older · fix not stated

• medium 6.4 Livemesh Addons by Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-1572 · affected 9.0 and older · fix not stated

• medium 6.1 Customer Reviews for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2026-3355 · affected 5.101.0 and older · fixed in 5.102.0 *

• high 7.5 Payment Gateway for Redsys & WooCommerce Lite

  Security issue

  CVE-2026-5050 · affected 7.0.0 and older · fixed in 7.0.1 *

• medium 6.5 Accessibility Suite by Ability, Inc

  SQL injection

  CVE-2026-3773 · affected 4.20 and older · fix not stated

• high 8.8 AcyMailing

  Privilege escalation

  CVE-2026-3614 · affected 9.11.0 to 10.8.1 · fixed in 10.8.2 *

• high 7.5 Riaxe Product Customizer

  SQL injection

  CVE-2026-3599 · affected 2.1.2 and older · fix not stated

• critical 9.8 Riaxe Product Customizer

  Privilege escalation

  CVE-2026-3596 · affected 2.1.2 and older · fix not stated

• medium 5.3 Riaxe Product Customizer

  Missing authorization check

  CVE-2026-3595 · affected 2.1.2 and older · fix not stated

• medium 5.3 Basic Google Maps Placemarks

  Missing authorization check

  CVE-2026-3581 · affected 1.10.7 and older · fixed in 1.10.8 *

• medium 4.4 Custom New User Notification

  Stored cross-site scripting (XSS)

  CVE-2026-3551 · affected 1.2.0 and older · fix not stated

• medium 6.1 CodeColorer

  Stored cross-site scripting (XSS)

  CVE-2026-4032 · affected 0.10.1 and older · fixed in 0.10.2 *

• medium 6.4 WP Docs

  Stored cross-site scripting (XSS)

  CVE-2026-3878 · affected 2.2.9 and older · fixed in 2.3.0 *

• medium 6.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2026-3885 · affected 7.4.9 and older · fixed in 7.5.0 *

• medium 6.4 WP YouTube Lyte

  Stored cross-site scripting (XSS)

  CVE-2026-3299 · affected 1.7.29 and older · fixed in 1.7.30 *

• critical 9.8 Barcode Scanner (+Mobile App)

  Privilege escalation

  CVE-2026-4880 · affected 1.11.0 and older · fixed in 1.12.1 *

Wednesday, April 15, 2026 · 38

• medium 4.3 ProfilePress

  Missing authorization check

  CVE-2026-4949 · affected 4.16.12 and older · fixed in 4.16.13 *

• medium 5.9 Mini Ajax Cart for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-6370 · affected 1.3.4 and older · fixed in 1.3.5

• high 7.5 Accept Cryptocurrencies with Plisio

  Missing authorization check

  CVE-2026-6372 · affected 2.0.5 and older · fixed in 2.0.6 *

• medium 4.3 Smart Online Order for Clover

  Cross-site request forgery (CSRF)

  CVE-2025-15635 · affected 1.6.0 and older · fixed in 1.6.1 *

• high 7.6 WCFM Marketplace

  SQL injection

  CVE-2025-63029 · affected 3.7.1 and older · fixed in 3.7.2 *

• medium 6.5 Video Gallery

  Stored cross-site scripting (XSS)

  CVE-2025-15636 · affected 3.5.1 and older · fixed in 3.5.2

• high 8.1 FluentBoards

  Missing authorization check

  CVE-2026-40784 · affected 1.91.2 and older · fixed in 1.91.3

• medium 4.3 MyRewards

  Missing authorization check

  CVE-2026-40786 · affected 5.7.3 and older · fixed in 5.7.4

• high 7.6 Element Pack Addons for Elementor

  SQL injection

  CVE-2026-40745 · affected 8.4.2 and older · fixed in 8.5.0

• high 8.5 Beaver Builder Page Builder

  SQL injection

  CVE-2026-40744 · affected 2.10.1.2 and older · fixed in 2.10.1.5

• medium 5.3 COMPE

  Missing authorization check

  CVE-2026-40737 · affected 1.1.4 and older · fixed in 1.1.5

• medium 5.3 Majestic Support

  Missing authorization check

  CVE-2026-40778 · affected 1.1.2 and older · fixed in 1.1.3

• medium 5.3 Nelio A/B Testing

  Missing authorization check

  CVE-2026-40742 · affected 8.2.8 and older · fixed in 8.3.0

• medium 5.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2026-40763 · affected 1.7.1056 and older · fixed in 1.7.1057

• medium 5.4 Tutor LMS

  Missing authorization check

  CVE-2026-40740 · affected 3.9.7 and older · fixed in 3.9.8

• high 8.1 WPForms

  Cross-site request forgery (CSRF)

  CVE-2026-40764 · affected 1.10.0.2 and older · fixed in 1.10.0.3

• medium 4.3 3D Viewer

  Missing authorization check

  CVE-2026-40729 · affected 1.8.5 and older · fixed in 1.8.6

• medium 6.5 Categories Images

  Cross-site scripting (XSS)

  CVE-2026-40734 · affected 3.3.1 and older · fixed in 3.3.2

• medium 4.3 Magazine Blocks

  Missing authorization check

  CVE-2026-40728 · affected 1.8.3 and older · fixed in 1.8.4

• medium 5.3 Starter Templates & Sites Pack by ThemeGrill

  Missing authorization check

  CVE-2026-40730 · affected 2.0.0.6 and older · fixed in 2.0.0.7

• high 8.8 Login as User

  Privilege escalation

  CVE-2026-5617 · affected 1.0.1 and older · fix not stated

• medium 6.1 OPEN-BRAIN

  Cross-site request forgery (CSRF)

  CVE-2026-4091 · affected 0.5.0 and older · fix not stated

• high 7.2 Quick Interest Slider

  Stored cross-site scripting (XSS)

  CVE-2026-5694 · affected 3.1.5 and older · fixed in 3.1.6 *

• medium 6.4 VI

  Stored cross-site scripting (XSS)

  CVE-2026-5717 · affected 0.4.200706 and older · fix not stated

• medium 6.4 Coachific Shortcode

  Stored cross-site scripting (XSS)

  CVE-2026-4005 · affected 1.0 and older · fix not stated

• medium 4.3 Petje.af

  Cross-site request forgery (CSRF)

  CVE-2026-4002 · affected 2.1.8 and older · fix not stated

• medium 6.4 WM JqMath

  Stored cross-site scripting (XSS)

  CVE-2026-3998 · affected 1.3 and older · fix not stated

• medium 6.4 WP Circliful

  Stored cross-site scripting (XSS)

  CVE-2026-3659 · affected 1.2 and older · fix not stated

• medium 6.4 Power Charts

  Stored cross-site scripting (XSS)

  CVE-2026-4011 · affected 0.1.0 and older · fix not stated

• medium 5.3 e-shot

  Missing authorization check

  CVE-2026-3642 · affected 1.0.2 and older · fix not stated

• medium 5.3 Katalogportal-pdf-sync Widget

  Missing authorization check

  CVE-2026-3649 · affected 1.0.0 and older · fix not stated

• high 7.2 Accessibly

  Stored cross-site scripting (XSS)

  CVE-2026-3643 · affected 3.0.3 and older · fix not stated

• critical 9.8 Visa Acceptance Solutions

  Authentication bypass

  CVE-2026-3461 · affected 2.1.0 and older · fixed in 2.1.1 *

• medium 4.3 Inquiry form to posts or pages

  Cross-site request forgery (CSRF)

  CVE-2026-6293 · affected 1.0 and older · fix not stated

• medium 5.3 Advanced Custom Fields (ACF®)

  Missing authorization check

  CVE-2026-4812 · affected 6.7.0 and older · fixed in 6.7.1 *

• high 7.2 Age Verification & Identity Verification by To…

  Stored cross-site scripting (XSS)

  CVE-2026-2834 · affected 3.32.3 and older · fixed in 3.32.4 *

• medium 4.4 List View Google Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-2396 · affected 7.4.3 and older · fixed in 7.4.4 *

• medium 5.3 3D FlipBook

  Missing authorization check

  CVE-2026-1314 · affected 1.16.17 and older · fix not stated

Tuesday, April 14, 2026 · 9

• medium 5.3 Nexi XPay

  Missing authorization check

  CVE-2025-15565 · affected 8.3.0 and older · fixed in 8.3.1 *

• medium 6.5 Germanized for WooCommerce

  Remote code execution

  CVE-2026-2582 · affected 3.20.5 and older · fixed in 3.20.6 *

• high 7.2 Smart Post

  PHP object injection

  CVE-2026-3017 · affected 3.0.12 and older · fixed in 3.0.13 *

• medium 4.4 WholeSale Products Dynamic Pricing Management…

  Stored cross-site scripting (XSS)

  CVE-2026-4479 · affected 1.2 and older · fix not stated

• medium 6.4 ShopLentor

  Stored cross-site scripting (XSS)

  CVE-2026-4059 · affected 3.3.5 and older · fixed in 3.3.6 *

• medium 6.4 Surbma

  Stored cross-site scripting (XSS)

  CVE-2026-1607 · affected 2.1 and older · fixed in 2.1.1 *

• high 7.2 BackWPup

  Remote code execution

  CVE-2026-6227 · affected 5.6.6 and older · fixed in 5.6.7 *

• high 7.2 Form Maker by 10Web

  Stored cross-site scripting (XSS)

  CVE-2026-4388 · affected 1.15.40 and older · fixed in 1.15.41 *

• critical 9.1 LearnPress

  Missing authorization check

  CVE-2026-4365 · affected 4.3.2.8 and older · fixed in 4.3.3 *

Monday, April 13, 2026 · 3

• medium 6.1 User Registration & Membership

  Open redirect

  CVE-2026-6203 · affected 5.1.4 and older · fixed in 5.1.5 *

• high 8.6 Product Filter for WooCommerce by WBW

  SQL injection

  CVE-2026-3830 · affected older than 3.1.3 · fixed in 3.1.3

• medium 6.8 Form Maker by 10Web

  SQL injection

  CVE-2025-15441 · affected older than 1.15.38 · fixed in 1.15.38

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan