WordPress plugin vulnerabilities: week 19, 2026

56 vulnerabilities published May 4 – May 10, 2026 in 46 plugins we track, by day.

3 critical 11 high 42 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, May 9, 2026 · 2

• medium 5.3 Activity Logs, User Activity Tracking, Multisi…

  Authentication bypass

  CVE-2026-8198 · affected 3.3.6 and older · fixed in 3.3.7 *

• medium 5.3 Appointment Booking Plugin

  Weak password recovery

  CVE-2026-7652 · affected 5.5.0 and older · fixed in 5.5.1 *

Friday, May 8, 2026 · 6

• medium 6.4 E2Pdf

  Stored cross-site scripting (XSS)

  CVE-2026-7650 · affected 1.32.17 and older · fixed in 1.32.18 *

• medium 6.4 Sky Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-7475 · affected 3.3.2 and older · fixed in 3.3.3 *

• medium 6.4 NMR Strava activities

  Stored cross-site scripting (XSS)

  CVE-2026-5341 · affected 1.0.14 and older · fixed in 1.0.15 *

• high 7.2 Auto Affiliate Links

  Stored cross-site scripting (XSS)

  CVE-2026-7330 · affected 6.8.8 and older · fixed in 6.8.8.1 *

• high 8.8 User Frontend

  PHP object injection

  CVE-2026-5127 · affected 4.3.1 and older · fixed in 4.3.2 *

• high 8.6 OttoKit

  SQL injection

  CVE-2026-4935 · affected older than 1.1.23 · fixed in 1.1.23

Thursday, May 7, 2026 · 14

• medium 4.3 BEAR

  Cross-site request forgery (CSRF)

  CVE-2026-27415 · affected 1.1.5 and older · fixed in 1.1.6

• medium 5.3 HappyAddons for Elementor

  Information disclosure

  CVE-2026-25468 · affected 3.20.8 and older · fixed in 3.21.0

• medium 5.3 PDF Poster

  Missing authorization check

  CVE-2026-27416 · affected 2.4.1 and older · fixed in 2.5.0

• medium 6.5 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-27421 · affected older than 1.7.1053 · fixed in 1.7.1053

• medium 5.3 YITH WooCommerce Wishlist

  Missing authorization check

  CVE-2026-27329 · affected 4.12.0 and older · fixed in 4.13.0

• medium 5.3 Bus Ticket Booking with Seat Reservation

  Missing authorization check

  CVE-2025-66105 · affected older than 5.6.8 · fixed in 5.6.8

• medium 5.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2026-25436 · affected older than 1.7.1053 · fixed in 1.7.1053

• high 7.6 Team Members

  SQL injection

  CVE-2025-68060 · affected 8.5 and older · fixed in 8.6

• medium 5.9 WEN Logo Slider

  Cross-site scripting (XSS)

  CVE-2025-62127 · affected 3.4.0 and older · fixed in 3.5

• medium 5.4 WPGraphQL

  Cross-site request forgery (CSRF)

  CVE-2025-68604 · affected 2.5.3 and older · fixed in 2.5.4

• high 8.1 WP-Optimize

  Arbitrary file deletion

  CVE-2026-7252 · affected 4.5.2 and older · fixed in 4.5.3 *

• medium 6.5 Forminator Forms

  Missing authorization check

  CVE-2026-6214 · affected 1.53.0 and older · fixed in 1.53.0.1 *

• medium 6.5 Simply Schedule Appointments

  Missing authorization check

  CVE-2026-4807 · affected 1.6.10.6 and older · fixed in 1.6.11.0 *

• medium 5.3 Forminator Forms

  Missing authorization check

  CVE-2026-6222 · affected 1.51.1 and older · fixed in 1.52 *

Wednesday, May 6, 2026 · 6

• medium 6.4 Appointment Booking Plugin

  Stored cross-site scripting (XSS)

  CVE-2026-7457 · affected 5.5.0 and older · fixed in 5.5.1 *

• high 7.2 Appointment Booking Plugin

  Stored cross-site scripting (XSS)

  CVE-2026-7332 · affected 5.5.0 and older · fixed in 5.5.1 *

• medium 4.9 Fluent Forms

  Path traversal / file read

  CVE-2026-6344 · affected 6.2.1 and older · fixed in 6.2.2 *

• medium 6.4 Affiliate Program Suite

  Stored cross-site scripting (XSS)

  CVE-2026-6672 · affected 1.2.7 and older · fixed in 1.2.8 *

• medium 4.3 Ninja Tables

  Missing authorization check

  CVE-2026-2306 · affected 5.2.6 and older · fixed in 5.2.7 *

• medium 5.3 Mercado Pago payments for WooCommerce

  Missing authorization check

  CVE-2026-3208 · affected 8.7.11 and older · fixed in 8.7.12 *

Tuesday, May 5, 2026 · 28

• high 7.5 Form Maker by 10Web

  SQL injection

  CVE-2026-3359 · affected 1.15.42 and older · fixed in 1.15.43 *

• medium 4.3 User Registration & Membership

  Missing authorization check

  CVE-2026-3601 · affected 5.1.4 and older · fixed in 5.1.5 *

• high 7.5 Forminator Forms

  Path traversal / file read

  CVE-2026-5192 · affected 1.52.1 and older · fixed in 1.52.2 *

• medium 6.5 GenerateBlocks

  Missing authorization check

  CVE-2026-3454 · affected 2.2.0 and older · fixed in 2.2.1 *

• critical 9.3 WebinarIgnition

  SQL injection

  CVE-2026-40797 · affected 4.08.253 and older · fixed in 4.09.86 *

• medium 5.3 Forminator Forms

  Missing authorization check

  CVE-2026-2729 · affected 1.52.0 and older · fixed in 1.52.1 *

• medium 6.5 ElementsKit Elementor Addons

  Missing authorization check

  CVE-2026-4362 · affected 3.8.2 and older · fixed in 3.9.0 *

• medium 6.5 EmailKit

  Path traversal / file read

  CVE-2026-5957 · affected 1.6.5 and older · fixed in 1.6.6 *

• critical 9.8 Geeky Bot

  Remote code execution

  CVE-2026-5294 · affected 1.2.2 and older · fixed in 1.2.7 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-5159 · affected 1.7.1056 and older · fixed in 1.7.1057 *

• high 7.2 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-4803 · affected 1.7.1056 and older · fixed in 1.7.1057 *

• medium 6.4 AI-Powered Carousel, Slider, Video & Photo Gal…

  Stored cross-site scripting (XSS)

  CVE-2026-4665 · affected 2.7.10 and older · fixed in 2.7.11 *

• high 7.5 Geeky Bot

  SQL injection

  CVE-2026-3456 · affected 1.2.0 and older · fixed in 1.2.7 *

• medium 6.4 Gutenverse

  Server-side request forgery (SSRF)

  CVE-2026-2948 · affected 3.5.3 and older · fixed in 3.6.0 *

• medium 6.1 Blog Settings

  Reflected cross-site scripting (XSS)

  CVE-2026-6704 · affected 1.0 and older · fix not stated

• medium 4.3 addfreespace

  Cross-site request forgery (CSRF)

  CVE-2026-6701 · affected 0.1.3 and older · fix not stated

• medium 4.3 DX Sources

  Cross-site request forgery (CSRF)

  CVE-2026-6700 · affected 2.0.1 and older · fix not stated

• medium 6.1 Publish 2 Ping.fm

  Cross-site request forgery (CSRF)

  CVE-2026-6702 · affected 1.1 and older · fix not stated

• medium 6.4 Simple Owl Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2026-6255 · affected 2.1.1 and older · fix not stated

• medium 6.4 WP-Clippy

  Stored cross-site scripting (XSS)

  CVE-2026-5505 · affected 1.0.0 and older · fix not stated

• medium 6.1 Zingaya Click-to-Call

  Reflected cross-site scripting (XSS)

  CVE-2026-6696 · affected 1.0 and older · fix not stated

• high 7.5 AWP Classifieds

  SQL injection

  CVE-2026-5100 · affected 4.4.5 and older · fixed in 4.4.6 *

• medium 6.4 Charts Ninja

  Stored cross-site scripting (XSS)

  CVE-2026-4730 · affected 2.1.0 and older · fix not stated

• medium 6.4 Gutenverse

  Stored cross-site scripting (XSS)

  CVE-2026-2868 · affected 3.5.3 and older · fixed in 3.6.0 *

• medium 4.9 Loco Translate

  Path traversal / file read

  CVE-2026-1921 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 5.5 Schedule Post Changes With PublishPress Future

  Stored cross-site scripting (XSS)

  CVE-2026-5247 · affected 4.10.0 and older · fixed in 4.10.1 *

• medium 6.5 Subscribe To Comments Reloaded

  Information disclosure

  CVE-2026-4409 · affected 240119 and older · fix not stated

• critical 9.8 MoreConvert Wishlist for WooCommerce

  Authentication bypass

  CVE-2026-5722 · affected 1.9.14 and older · fixed in 1.9.15 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan