WordPress plugin vulnerabilities: week 22, 2026
191 vulnerabilities published May 25 – May 31, 2026 in 174 plugins we track, by day.
14 critical 45 high 132 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, May 31, 2026 · 1
Saturday, May 30, 2026 · 3
-
high 7.5 GEO my WP
-
high 8.8 Spectra Legacy
-
high 7.5 Simple History
Friday, May 29, 2026 · 12
-
medium 5.3 Rank Math SEO
-
medium 5.3 Contact Form 7
Security issue
-
high 8.1 Media Library Assistant
-
medium 4.9 ACF Frontend Admin by DynamiApps
-
medium 6.4 The Plus Addons for Elementor
-
critical 9.8 OTP Login With Phone Number, OTP Verification
-
high 7.2 Link Whisper Free
-
medium 6.4 StatCounter
-
medium 6.4 Simple Divi Shortcode
-
medium 5.3 Breeze Cache
-
medium 4.3 Poll Maker by AYS
-
medium 4.4 Post Snippets
Thursday, May 28, 2026 · 30
-
critical 9.8 Advanced Custom Fields
-
medium 4.3 Equalize Digital Accessibility Checker
-
medium 4.3 PDF Embedder
-
medium 6.5 Photo Gallery by 10Web
-
medium 5.3 Simply Schedule Appointments
-
medium 4.3 Visualizer
-
high 8.8 ACF Frontend Admin by DynamiApps
-
medium 6.4 Shariff Wrapper
-
medium 4.3 3D Viewer
-
high 8.6 Eupago Gateway For Woocommerce
-
high 8.8 GutenBee
-
medium 4.3 PeachPay
-
high 7.5 Simply Schedule Appointments
-
medium 6.1 Easy Updates Manager
-
medium 5.3 User Registration & Membership
-
medium 6.4 a3 Lazy Load
-
medium 5.3 Geo Mashup
-
high 7.2 HT Contact Form
-
medium 4.3 SMTP2GO for WordPress
-
high 8.1 WP Contact Form 7 DB Handler
-
high 7.2 SlimStat Analytics
-
medium 6.4 LiveSmart Video Chat Live Video Chat
-
medium 4.3 Easy Digital Downloads
-
medium 6.5 Meta Field Block
-
medium 4.3 Timetable and Event Schedule by MotoPress
-
medium 4.3 FOX
-
high 8.8 ACF Frontend Admin by DynamiApps
-
medium 6.5 Independent Analytics
-
high 7.2 Login No Captcha reCAPTCHA
-
medium 4.3 Everest Forms
Wednesday, May 27, 2026 · 115
-
medium 4.3 The Post Grid
-
medium 4.3 affects latest 2.1.2 Account Manager for WooCommerce
-
medium 4.3 DearFlip
-
high 8.5 Duplicate Page and Post
-
medium 5.3 ElementsKit Elementor Addons
-
medium 4.3 ElementsKit Elementor Addons
-
medium 4.7 Meta for WooCommerce
-
medium 4.3 WP Meta and Date Remover
-
medium 4.3 Adminimize
-
medium 6.5 Advanced Custom Fields
-
medium 4.3 SVG Support
-
medium 4.3 Product Import Export for WooCommerce
-
high 7.1 Affiliate Super Assistent
-
critical 9.3 Active Woot Products Tables for WooCommerce. 1…
-
critical 9.9 QuickWebP
-
critical 9.8 WebinarIgnition
-
critical 9.9 WebinarIgnition
-
medium 6.5 Booking Manager
-
high 7.3 Smart Online Order for Clover
-
critical 9.3 Easy Form Builder by WhiteStudio
-
high 7.1 Favicon by RealFaviconGenerator
-
critical 9.3 TableOn
-
high 7.3 WCFM Membership
-
medium 6.5 WPComplete
-
critical 9.9 WPify Woo
-
high 7.1 Advanced IP Blocker
-
high 7.5 Better Messages
-
high 7.3 Smart Online Order for Clover
-
high 7.1 Smart Online Order for Clover
-
high 8.2 KiviCare
-
medium 6.5 Quads Ads Manager for Google AdSense
Security issue
-
critical 9.3 Tainacan
-
high 7.1 WPCS
-
high 7.1 Geo Mashup
-
high 7.1 HT Contact Form
-
high 8.5 MasterStudy LMS WordPress Plugin
-
critical 9.8 miniOrange OTP Login, Verification and SMS Not…
-
critical 9.3 Active Woot Products Tables for WooCommerce. 1…
-
high 7.1 Property Hive
-
medium 6.5 Quads Ads Manager for Google AdSense
Security issue
-
medium 6.5 AWP Classifieds
-
medium 6.5 Checkout Files Upload for WooCommerce
-
medium 6.1 MinhNhut Link Gateway
-
medium 4.4 MinhNhut Link Gateway
-
medium 4.8 myLinksDump
-
medium 4.8 rexCrawler
-
medium 6.5 Master Slider
-
medium 6.5 GenerateBlocks
-
medium 4.9 EnvíaloSimple
-
medium 6.4 Github Shortcode
-
high 8.8 WPCode
-
medium 4.3 MetaMagic SEO Plugin
-
medium 6.1 WP Promoter
-
high 7.2 affiliate-toolkit
-
medium 6.4 Livemesh Addons for Beaver Builder
-
medium 6.4 WPBakery Page Builder Addons by Livemesh
-
medium 6.4 WPBakery Page Builder Addons by Livemesh
-
medium 6.5 Enable jQuery Migrate Helper
-
medium 6.1 Gutenverse
-
high 7.2 LiteSpeed Cache
-
medium 6.4 Livemesh SiteOrigin Widgets
-
high 7.5 Query Shortcode
-
medium 5.3 WP Promoter
-
medium 4.3 auto making JSON-LD
-
medium 6.4 Auto Thumbnails
-
medium 4.3 GoStats for WordPress
-
high 8.1 Login with NEAR
-
medium 4.3 CDN Linker lite
-
medium 4.3 Search Simple Fields
-
medium 6.1 WP AutoBuzz
-
medium 6.4 BitForm
-
medium 6.4 Easy Prism Syntax Highlighter
-
medium 6.4 Events In City
-
medium 6.4 hk_shortcode
-
medium 6.4 Instant-Quote.co Quotation Page
-
medium 6.4 iWR Tooltip
-
medium 6.4 Listen Shortcode
-
medium 6.4 Responsive Video Embedder
-
medium 6.4 Shortcode Buddy
-
medium 6.4 Animate Your Content
-
medium 6.4 Content Slideshow
-
medium 6.4 Formidable Kinetic
-
medium 6.4 Mutual Funds Data
-
medium 6.4 Post Categories Gallery
-
medium 6.4 Single Mailchimp
-
medium 6.4 Team Master
-
high 8.8 Admin Chat Management
-
medium 6.4 Google+ Link Name
-
medium 6.4 Islamic Database
-
medium 6.4 jQuery googleslides
-
medium 6.4 Responsive Check
-
medium 6.4 Tuxquote
-
medium 6.4 Dideo
-
medium 6.4 WP Iframe Geo Style for Amazon affiliates
-
medium 6.4 Cryptocurrency Prijsvergelijking Widget
-
medium 6.4 Endless Scroll
-
medium 6.4 GBI To Print
-
medium 4.3 Genzel breadcrumbs
-
medium 6.4 GNTT Post Title Ticker
-
medium 6.4 My Email Shortcode
-
critical 9.8 Login with OTP
-
medium 6.1 NS Product icon badge
-
medium 6.4 faq shortocde
-
medium 4.3 Old Posts Highlighter
-
medium 4.3 CM Ad Changer
-
medium 5.4 ShopLentor
-
medium 4.3 Yoast SEO
-
medium 6.4 Splide Carousel Block
-
medium 6.4 Style Kits for Elementor
-
medium 5.3 Simply Schedule Appointments
Tuesday, May 26, 2026 · 7
-
medium 6.3 Travelly
-
medium 4.3 Feeds for TikTok
-
medium 5.3 E-cab Taxi Booking Manager for Woocommerce
-
medium 4.3 Appointment Booking Plugin for WooCommerce
-
medium 4.3 RepairBuddy
-
medium 6.5 Geo Mashup
-
medium 5.3 Paid Videochat Turnkey Site
Monday, May 25, 2026 · 23
-
high 7.5 MyCryptoCheckout
-
medium 6.5 Payment Gateway of Stripe for WooCommerce
-
high 8.8 Smart Manager
-
medium 6.3 Sunshine Photo Cart
-
high 8.5 Unlimited Elements for Elementor
-
medium 6.5 WP Activity Log
-
high 7.1 cformsII
-
medium 6.5 SePay Gateway
-
critical 9.3 affects latest 1.3.2 eMagicOne Store Manager for WooCommerce
-
high 7.2 Broadcast Live Video
-
medium 4.9 B2BKing
-
medium 5.3 RSVP and Event Management
-
medium 5.3 Search Analytics for WP
-
medium 5.3 Auto Affiliate Links
-
medium 4.3 FlexTable
-
medium 6.5 affects latest 1.22.28 Team Showcase
-
medium 6.5 Export WordPress Pages to Static HTML & PDF
-
medium 4.3 Organization chart
-
medium 4.3 QR Redirector
-
medium 5.3 GamiPress
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.