WordPress plugin vulnerabilities: week 21, 2026
73 vulnerabilities published May 18 – May 24, 2026 in 69 plugins we track, by day.
3 critical 15 high 55 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, May 23, 2026 · 1
Friday, May 22, 2026 · 14
-
high 7.5 Ditty
-
medium 5.3 MotoPress Hotel Booking
-
medium 4.3 Vedrixa Forms
-
high 7.5 AudioIgniter Music Player
-
medium 5.4 FluentCRM
-
medium 4.3 Slider by Soliloquy
-
medium 4.3 Widget Context
-
high 8.8 Easy Elements for Elementor
-
medium 6.4 Draft List
-
medium 4.3 Alfie
-
medium 6.1 CBX 5 Star Rating & Review
-
medium 6.4 KIA Subtitle
-
medium 4.3 Location Weather
-
medium 6.1 WP Blockade
Thursday, May 21, 2026 · 7
-
medium 4.3 GSheet For Woo Importer
-
medium 6.5 HAPPY
-
critical 9.3 WP Directory Kit
-
medium 5.3 WOW Styler for CF7
-
medium 4.3 Mail Mint
-
medium 4.9 WPB Floating Menu or Categories
-
medium 4.3 Broadstreet
Wednesday, May 20, 2026 · 42
-
high 7.6 YITH WooCommerce Product Add-Ons
-
medium 4.3 Image Photo Gallery Final Tiles Grid
-
medium 6.5 Appointment Booking Plugin for WooCommerce
-
medium 6.5 Visualizer
-
medium 4.3 Anomify AI
-
high 8.8 AcyMailing
-
medium 4.3 Photo Gallery, Sliders, Proofing and Themes
-
medium 6.1 Email Encoder
-
medium 6.4 AI Copilot
-
medium 4.3 All in One SEO
-
medium 5.3 Xpro Addons
-
medium 6.5 Infility Global
-
medium 6.1 BLOGCHAT Chat System
-
medium 6.1 Correct Prices
-
medium 4.3 JaviBola Custom Theme Test
-
medium 6.1 LJ comments import
-
medium 4.3 Remove Yellow BGBOX
-
medium 6.1 SponsorMe
-
medium 4.3 TypeSquare Webfonts for ConoHa
-
medium 4.3 Amazon Scraper
-
critical 9.8 Easy Elements for Elementor
-
medium 4.9 Read More & Accordion
-
high 8.8 Read More & Accordion
-
medium 6.4 Faces of Users
-
medium 4.3 Games Catalog
-
medium 6.1 VatanSMS WP SMS
-
high 8.8 Account Switcher
-
medium 4.4 Anomify AI
-
medium 4.3 Bigfishgames Syndicate
-
medium 4.3 Bottom Bar
-
medium 4.3 Child Height Predictor by Ostheimer
-
medium 6.4 Logo Manager For Enamad
-
critical 9.8 ProSolution WP Client
-
medium 4.4 General Options
-
medium 5.4 Nexa Blocks
-
medium 6.5 Oliver POS
-
medium 6.4 診断ジェネレータ作成プラグイン
-
medium 6.4 Sticky
-
medium 6.1 Word 2 Cash
-
high 7.5 Creative Mail
Tuesday, May 19, 2026 · 5
-
medium 6.5 Kirki
-
high 7.5 Kirki
-
high 7.5 Contest Gallery
-
medium 4.3 Presto Player
-
high 7.5 Fortis for WooCommerce
Security issue
Monday, May 18, 2026 · 4
-
high 7.1 Ajax Load More
-
high 7.5 WP Maps
-
high 8.6 WP Photo Album Plus
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.