WordPress plugin vulnerabilities: week 25, 2026

327 vulnerabilities published Jun 15 – Jun 21, 2026 in 271 plugins we track, by day.

58 critical 154 high 114 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, June 20, 2026 · 5

• medium 6.5 Simple File List

  Missing authorization check

  CVE-2026-12119 · affected 6.3.7 and older · fix not stated

• high 7.5 Simple File List

  Missing authorization check

  CVE-2026-11912 · affected 6.3.7 and older · fix not stated

• high 7.5 Simple File List

  Arbitrary file deletion

  CVE-2026-11911 · affected 6.3.7 and older · fix not stated

• high 8.1 Database for Contact Form 7, WPforms, Elemento…

  Arbitrary file deletion

  CVE-2026-9843 · affected 1.5.1 and older · fixed in 1.5.2 *

• critical 9.8 Branda

  Privilege escalation

  CVE-2026-11551 · affected 3.4.29 and older · fixed in 3.4.31 *

Friday, June 19, 2026 · 15

• medium 5.3 WP Go Maps

  Missing authorization check

  CVE-2026-12238 · affected 10.1.01 and older · fixed in 10.1.02 *

• medium 5.3 2Download Connector for 2DL Hosted Checkout

  Missing authorization check

  CVE-2026-6798 · affected 0.1.5 and older · fixed in 0.1.6 *

• medium 5.3 STRABL

  Missing authorization check

  CVE-2026-3640 · affected 4.5 and older · fixed in 4.8.2 *

• medium 4.3 Bogo

  Information disclosure

  CVE-2026-9013 · affected 3.9.1 and older · fixed in 3.9.2 *

• medium 6.5 WP Hotel Booking

  Security issue

  CVE-2026-9822 · affected older than 2.3.1 · fixed in 2.3.1

• medium 4.9 Woosa

  Path traversal / file read

  CVE-2026-7547 · affected 2.0.5 and older · fixed in 2.0.6 *

• medium 6.5 Royal Addons for Elementor

  Path traversal / file read

  CVE-2026-8118 · affected 1.7.1058 to 1.7.1059 · fixed in 1.7.1060 *

• medium 6.4 Advanced Import

  Cross-site scripting (XSS)

  CVE-2026-4328 · affected 1.4.6 and older · fixed in 2.0.0 *

• medium 6.4 BetterDocs

  Stored cross-site scripting (XSS)

  CVE-2026-12157 · affected 4.5.3 and older · fixed in 4.5.4 *

• medium 6.5 Bit integrations

  Server-side request forgery (SSRF)

  CVE-2026-11989 · affected 2.8.7 and older · fixed in 2.8.8 *

• medium 4.4 Blocksy Companion

  Stored cross-site scripting (XSS)

  CVE-2026-12430 · affected 2.1.45 and older · fixed in 2.1.46 *

• medium 4.3 Classified Listing

  Missing authorization check

  CVE-2026-10779 · affected 5.4.2 and older · fixed in 5.4.3 *

• medium 6.4 Creavi Appointment Booking Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-1856 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 5.3 WP DSGVO Tools (GDPR)

  Cross-site request forgery (CSRF)

  CVE-2026-10034 · affected 3.1.39 and older · fixed in 3.1.40 *

• medium 4.3 User Admin Simplifier

  Cross-site request forgery (CSRF)

  CVE-2026-11775 · affected 3.0.0 and older · fixed in 3.0.1 *

Thursday, June 18, 2026 · 28

• medium 6.5 WP Easy Pay

  Cross-site request forgery (CSRF)

  CVE-2026-56024 · affected 4.5.0 and older · fixed in 4.5.1 *

• high 8.5 Media Library Assistant

  SQL injection

  CVE-2026-56012 · affected 3.35 and older · fixed in 3.36

• medium 5.9 Bricksable for Bricks Builder

  Stored cross-site scripting (XSS)

  CVE-2026-56009 · affected 1.6.83 and older · fixed in 1.6.84

• medium 5.9 Ocean Product Sharing

  Stored cross-site scripting (XSS)

  CVE-2026-56007 · affected 2.2.2 and older · fixed in 2.2.3

• medium 6.4 Fancy Testimonials

  Stored cross-site scripting (XSS)

  CVE-2026-8039 · affected 1.0 and older · fix not stated

• medium 6.4 Slideshow Gallery LITE

  Stored cross-site scripting (XSS)

  CVE-2026-2021 · affected 1.8.5 and older · fixed in 1.8.6 *

• medium 4.3 Appointment Booking Calendar

  Information disclosure

  CVE-2026-12111 · affected 1.4.01 and older · fixed in 1.4.02 *

• high 7.2 CF7 to Webhook

  Server-side request forgery (SSRF)

  CVE-2026-11395 · affected 5.0.0 and older · fixed in 5.0.1 *

• medium 6.1 SysBasics Customize My Account for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2026-12137 · affected 4.3.6 and older · fixed in 4.4.3 *

• medium 6.4 SysBasics Customize My Account for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2026-12136 · affected 4.3.6 and older · fixed in 4.4.3 *

• medium 6.4 PowerPress Podcasting plugin by Blubrry

  Stored cross-site scripting (XSS)

  CVE-2026-12098 · affected 11.16.8 and older · fixed in 11.16.9 *

• low 2.7 UsersWP

  Missing authorization check

  CVE-2026-12102 · affected 1.2.63 and older · fixed in 1.2.64 *

• high 8.8 Offload, AI & Optimize with Cloudflare Images

  Remote code execution

  CVE-2026-9860 · affected 1.10.2 and older · fixed in 1.10.3 *

• medium 4.3 Equalize Digital Accessibility Checker

  Missing authorization check

  CVE-2026-9199 · affected 1.42.1 and older · fixed in 1.43.0 *

• medium 5.3 FireBox

  Information disclosure

  CVE-2026-12120 · affected 3.1.7 and older · fixed in 3.1.8 *

• medium 4.9 Form Maker by 10Web

  SQL injection

  CVE-2026-11777 · affected 1.15.43 and older · fixed in 1.15.44 *

• medium 4.9 Form Maker by 10Web

  SQL injection

  CVE-2026-11776 · affected 1.15.43 and older · fixed in 1.15.44 *

• medium 4.3 Optimole

  Cross-site request forgery (CSRF)

  CVE-2026-11784 · affected 4.2.6 and older · fixed in 4.2.7 *

• medium 6.4 Services Section Block

  Stored cross-site scripting (XSS)

  CVE-2026-11402 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 5.3 Simple Membership

  Missing authorization check

  CVE-2026-12093 · affected 4.7.5 and older · fixed in 4.7.6 *

• medium 4.3 Kadence Blocks

  Information disclosure

  CVE-2026-11357 · affected 3.7.5 and older · fixed in 3.7.6 *

• medium 4.3 PressPrimer Quiz

  Missing authorization check

  CVE-2026-10623 · affected 2.3.0 and older · fixed in 2.3.1 *

• medium 4.4 Orbit Fox

  Stored cross-site scripting (XSS)

  CVE-2026-11358 · affected 3.0.6 and older · fixed in 3.0.7 *

• medium 4.9 Tutor LMS

  SQL injection

  CVE-2026-10736 · affected 3.9.11 and older · fixed in 3.9.12 *

• medium 4.9 Advanced Order Export For WooCommerce

  SQL injection

  CVE-2026-11360 · affected 4.0.10 and older · fixed in 4.1.0 *

• medium 5.3 Event Koi Lite

  Information disclosure

  CVE-2026-10029 · affected 1.3.13.1 and older · fixed in 1.3.14.0 *

• high 8.8 E2Pdf

  Missing authorization check

  CVE-2026-12407 · affected 1.32.26 and older · fixed in 1.32.31 *

• medium 4.3 Dokan

  Missing authorization check

  CVE-2026-10023 · affected 5.0.3 and older · fixed in 5.0.4 *

Wednesday, June 17, 2026 · 47

• high 7.5 Nexi XPay

  Missing authorization check

  CVE-2026-54810 · affected 8.3.1 and older · fixed in 8.3.2

• critical 9.3 Motors

  SQL injection

  CVE-2026-54812 · affected 1.4.109 and older · fixed in 1.4.110

• high 7.5 Advanced Ads

  Remote code execution

  CVE-2026-54816 · affected 2.0.21 and older · fixed in 2.0.22

• critical 9.3 Cargo Shipping Location for WooCommerce

  SQL injection

  CVE-2026-54815 · affected 5.6 and older · fixed in 5.7

• critical 9.3 Listdom

  SQL injection

  CVE-2026-54819 · affected 5.4.0 and older · fixed in 5.5.0

• high 8.1 Motors

  File inclusion

  CVE-2026-54814 · affected 1.4.109 and older · fixed in 1.4.110

• medium 6.5 MStore API

  Authentication bypass

  CVE-2026-54817 · affected 4.18.4 and older · fixed in 4.19.0

• high 8.5 SureDash

  SQL injection

  CVE-2026-54813 · affected 1.8.0 and older · fixed in 1.8.1

• high 8.5 SlimStat Analytics

  SQL injection

  CVE-2026-54818 · affected 5.4.11 and older · fixed in 5.4.12

• critical 9.3 GIFT4U

  SQL injection

  CVE-2026-54809 · affected 1.0.10 and older · fixed in 1.1.0

• critical 9.3 WP Travel Gutenberg Blocks

  SQL injection

  CVE-2026-54808 · affected 3.9.4 and older · fixed in 3.9.5

• medium 6.4 Points Management System For Gamification, Ran…

  Stored cross-site scripting (XSS)

  CVE-2026-8607 · affected 3.1 and older · fixed in 3.1.1 *

• high 7.1 Taskbuilder

  Reflected cross-site scripting (XSS)

  CVE-2026-9570 · affected older than 5.0.8 · fixed in 5.0.8

• medium 5.3 LearnPress

  Missing authorization check

  CVE-2026-8383 · affected older than 4.3.7 · fixed in 4.3.7

• medium 6.4 Permalink Manager Lite

  Stored cross-site scripting (XSS)

  CVE-2026-8494 · affected 2.5.3.3 and older · fixed in 2.5.3.4 *

• high 8.8 Falang multilanguage for WordPress

  Privilege escalation

  CVE-2026-54805 · affected 1.4.2 and older · fixed in 1.4.3

• high 7.6 Melhor Envio

  Authentication bypass

  CVE-2026-54804 · affected 2.16.3 and older · fixed in 2.16.4

• critical 9.8 Registration Form for WooCommerce

  Privilege escalation

  CVE-2026-54807 · affected 1.0.9 and older · fixed in 1.1.0

• critical 9.8 SMS Alert

  Privilege escalation

  CVE-2026-54803 · affected 3.9.4 and older · fixed in 3.9.5

• high 7.5 SMS Alert

  Missing authorization check

  CVE-2026-54802 · affected 3.9.3 and older · fixed in 3.9.4

• critical 9.8 WP Activity Log

  PHP object injection

  CVE-2026-54806 · affected 5.6.3.1 and older · fixed in 5.6.4

• high 7.1 Popup Box

  Cross-site scripting (XSS)

  CVE-2026-54192 · affected 6.2.9 and older · fixed in 6.3.0

• medium 6.8 JetFormBuilder

  Privilege escalation

  CVE-2026-54196 · affected 3.6.1 and older · fixed in 3.6.1.1

• high 7.1 JetFormBuilder

  Cross-site scripting (XSS)

  CVE-2026-54195 · affected 3.6.0.1 and older · fixed in 3.6.1

• high 8.2 Clean Login

  Missing authorization check

  CVE-2026-54184 · affected 1.15 and older · fixed in 1.16

• high 8.5 Cornerstone

  SQL injection

  CVE-2026-54185 · affected older than 7.8.8 · fixed in 7.8.8

• high 7.4 PushEngage

  Information disclosure

  CVE-2026-52698 · affected 4.2.3 and older · fixed in 4.2.4

• high 8.5 Cornerstone

  Remote code execution

  CVE-2026-49113 · affected older than 7.8.8 · fixed in 7.8.8

• critical 9.3 wpDataTables

  SQL injection

  CVE-2026-49080 · affected 7.3.6 and older · fixed in 7.4

• critical 9.8 wpForo Forum

  Authentication bypass

  CVE-2026-49767 · affected 3.1.0 and older · fixed in 3.1.1

• high 8.5 Geo Mashup

  SQL injection

  CVE-2026-48967 · affected 1.13.19 and older · fixed in 1.13.20

• high 7.1 Chatbot for WordPress by Collect.chat ⚡️

  Cross-site scripting (XSS)

  CVE-2026-40765 · affected 2.4.9 and older · fixed in 2.5.0

• high 7.3 Salon Booking System

  Missing authorization check

  CVE-2026-40768 · affected 10.30.24 and older · fixed in 10.30.25

• medium 4.7 W3 Total Cache

  Missing authorization check

  CVE-2026-39595 · affected 2.9.1 and older · fixed in 2.9.2

• high 7.1 WPZOOM Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-39597 · affected 1.3.4 and older · fixed in 1.3.5

• medium 6.5 SlimStat Analytics

  PHP object injection

  CVE-2026-27410 · affected older than 5.4.0 · fixed in 5.4.0

• high 7.5 Woocommerce Book Price

  Path traversal / file read

  CVE-2026-22334 · affected 1.3 and older · fix not stated

• high 8.8 Contest Gallery

  Privilege escalation

  CVE-2026-12165 · affected 30.0.2 and older · fixed in 30.0.7 *

• medium 6.6 Counter Box

  PHP object injection

  CVE-2026-12115 · affected 2.0.13 and older · fixed in 2.0.14 *

• medium 6.5 AliNext

  Missing authorization check

  CVE-2024-37210 · affected 3.3.5 and older · fixed in 3.3.7

• medium 4.3 Emergency password reset

  Cross-site request forgery (CSRF)

  CVE-2024-35648 · affected 8.0 and older · fixed in 9.0

• medium 6.5 Widget Options

  Information disclosure

  CVE-2024-35690 · affected 4.0.1 and older · fixed in 4.0.2

• high 7.5 WPBot

  Path traversal / file read

  CVE-2024-32729 · affected 1.1.8 and older · fixed in 1.2.0

• high 8.3 File Manager for Google Drive

  Missing authorization check

  CVE-2024-32949 · affected 1.3.8 and older · fixed in 1.3.91

• medium 5.3 iPages

  Missing authorization check

  CVE-2024-33909 · affected 1.5.1 and older · fixed in 1.5.2

• medium 4.3 Social Media Share Buttons & Social Sharing Ic…

  Missing authorization check

  CVE-2024-31435 · affected 2.8.6 and older · fixed in 2.8.7

• medium 4.3 Professional Social Sharing Buttons, Icons & R…

  Missing authorization check

  CVE-2024-24709 · affected 9.7.11 and older · fixed in 9.7.12

Tuesday, June 16, 2026 · 23

• medium 6.5 Envira Gallery

  Missing authorization check

  CVE-2026-54190 · affected 1.12.5 and older · fixed in 1.12.6

• critical 9.3 GEO my WP

  SQL injection

  CVE-2026-52715 · affected 4.5.5 and older · fixed in 4.5.5.1

• medium 6.5 GetGenie

  Information disclosure

  CVE-2026-54197 · affected 4.4.1 and older · fixed in 4.4.2

• high 7.5 Appointment Booking Plugin

  Privilege escalation

  CVE-2026-8176 · affected 5.5.1 and older · fixed in 5.5.2 *

• high 7.1 Media Library Assistant

  Cross-site scripting (XSS)

  CVE-2026-54198 · affected 3.35 and older · fixed in 3.36

• high 7.1 Pods

  Cross-site scripting (XSS)

  CVE-2026-54191 · affected 3.3.8 and older · fixed in 3.3.9

• medium 5.9 GEO Plugin by Squirrly SEO

  Missing authorization check

  CVE-2026-52714 · affected 12.4.16 and older · fixed in 12.4.17

• high 8.5 WP Sessions Time Monitoring Full Automatic

  SQL injection

  CVE-2026-39581 · affected 1.1.4 and older · fixed in 1.1.5

• high 7.6 Attendance Manager

  SQL injection

  CVE-2026-52712 · affected 0.6.2 and older · fixed in 0.6.3

• critical 9.3 InPost Gallery

  SQL injection

  CVE-2026-39574 · affected 2.1.4.6 and older · fixed in 2.1.5

• critical 9.9 RD Station

  Remote code execution

  CVE-2026-49774 · affected 5.6.0 and older · fixed in 5.7.0

• high 7.5 Jupiter X Core

  Missing authorization check

  CVE-2026-39490 · affected 4.14.1 and older · fixed in 4.14.2

• critical 9.3 The Events Calendar

  SQL injection

  CVE-2026-49772 · affected 6.15.12 to 6.16.2 · fixed in 6.16.3

• high 7.5 WCPOS

  Missing authorization check

  CVE-2026-52711 · affected 1.8.14 and older · fixed in 1.9.0

• high 7.1 Min Max Step Quantity Limits Manager for WooCo…

  Cross-site scripting (XSS)

  CVE-2026-39437 · affected 5.2.2 and older · fixed in 5.2.3

• medium 6.5 WooCommerce Stripe Payment Gateway

  Missing authorization check

  CVE-2026-2381 · affected 10.7.0 and older · fixed in 10.7.1 *

• high 7.5 Eventin

  Missing authorization check

  CVE-2025-68045 · affected 4.1.12 and older · fixed in 4.1.13

• medium 6.4 User Private Files

  Stored cross-site scripting (XSS)

  CVE-2026-10093 · affected 2.1.6 and older · fixed in 2.1.7 *

• medium 5.3 Abandoned Contact Form 7

  Missing authorization check

  CVE-2026-9187 · affected 2.2 and older · fix not stated

• high 8.8 Premmerce Dev Tools

  Remote code execution

  CVE-2026-6933 · affected 2.0 and older · fix not stated

• medium 6.5 RTMKit for Elementor

  Missing authorization check

  CVE-2026-5149 · affected 2.0.7 and older · fixed in 2.0.8 *

• medium 4.3 Static Block

  Missing authorization check

  CVE-2026-10780 · affected 2.2 and older · fix not stated

• medium 5.3 Video Conferencing with Zoom

  Missing authorization check

  CVE-2026-6964 · affected 4.6.7 and older · fixed in 4.6.8 *

Monday, June 15, 2026 · 209

• critical 9.8 Integration for ActiveCampaign and Contact For…

  PHP object injection

  CVE-2026-9691 · affected 1.1.1 and older · fixed in 1.1.2

• critical 9.6 FastDup

  Path traversal / file read

  CVE-2026-52703 · affected 2.7.2 and older · fixed in 2.7.3

• high 7.5 ABC Crypto Checkout

  Information disclosure

  CVE-2026-52695 · affected 1.8.2 and older · fixed in 1.8.3

• high 7.1 SEO Redirection Plugin

  Cross-site scripting (XSS)

  CVE-2026-52702 · affected 9.17 and older · fixed in 9.18

• high 8.5 Taskbuilder

  SQL injection

  CVE-2026-52697 · affected 5.0.7 and older · fixed in 5.0.8

• high 7.5 VikRentCar Car Rental Management System

  Missing authorization check

  CVE-2026-52699 · affected 1.4.5 and older · fixed in 1.4.6

• high 8.5 WCMultiShipping

  SQL injection

  CVE-2026-52700 · affected 3.0.2 and older · fixed in 3.0.3

• high 7.5 Digital Signature Add-on for WooCommerce

  Information disclosure

  CVE-2026-52694 · affected 2.0 and older · fixed in 2.0.1

• high 7.5 Affiliates Manager

  Information disclosure

  CVE-2026-52692 · affected 2.9.50 and older · fixed in 2.9.51

• critical 9.3 eCommerce Product Catalog

  SQL injection

  CVE-2026-52693 · affected 3.5.5 and older · fixed in 3.5.6

• high 8.8 Dokan

  Privilege escalation

  CVE-2026-49780 · affected 5.0.2 and older · fixed in 5.0.3

• medium 6.5 FV Flowplayer Video Player

  Cross-site scripting (XSS)

  CVE-2026-49773 · affected older than 7.5.51.7212 · fixed in 7.5.51.7212

• critical 9.3 GPTranslate

  SQL injection

  CVE-2026-49776 · affected 2.32.6 and older · fixed in 2.32.7

• critical 9.8 OttoKit

  PHP object injection

  CVE-2026-49781 · affected 1.1.27 and older · fixed in 1.1.28

• medium 6.5 Welcart e-Commerce

  Missing authorization check

  CVE-2026-49775 · affected 2.11.28 and older · fixed in 2.11.29

• critical 9.8 WP Travel Engine

  PHP object injection

  CVE-2026-49770 · affected 6.7.12 and older · fixed in 6.8.0

• critical 9.8 Integration for HubSpot and Contact Form 7, WP…

  PHP object injection

  CVE-2026-49763 · affected 1.3.7 and older · fixed in 1.3.8

• critical 9.8 Integration for Mailchimp and Contact Form 7,…

  PHP object injection

  CVE-2026-49765 · affected 1.1.8 and older · fixed in 1.1.9

• critical 9.8 RegistrationMagic

  Authentication bypass

  CVE-2026-49764 · affected 6.0.8.6 and older · fixed in 6.0.8.7

• critical 9.8 Happyforms

  PHP object injection

  CVE-2026-49768 · affected 1.26.13 and older · fixed in 1.26.14

• critical 9.9 WP User Manager

  Arbitrary file deletion

  CVE-2026-49766 · affected 2.9.16 and older · fixed in 2.9.17

• critical 9.8 wpForo Forum

  PHP object injection

  CVE-2026-49769 · affected 3.1.0 and older · fixed in 3.1.1

• critical 9.8 Integration for Constant Contact and Contact F…

  PHP object injection

  CVE-2026-49106 · affected 1.1.6 and older · fixed in 1.1.7

• critical 9.8 Integration for Keap/infusionsoft and Contact…

  PHP object injection

  CVE-2026-49104 · affected 1.2.1 and older · fixed in 1.2.2

• critical 9.8 WP Insightly for Contact Form 7, WPForms, Elem…

  PHP object injection

  CVE-2026-49085 · affected 1.1.4 and older · fixed in 1.1.5

• critical 9.8 Integration for Salesforce and Contact Form 7,…

  PHP object injection

  CVE-2026-49109 · affected 1.4.3 and older · fixed in 1.4.4

• critical 9.8 WP Zendesk for Contact Form 7, WPForms, Elemen…

  PHP object injection

  CVE-2026-49105 · affected 1.1.4 and older · fixed in 1.1.5

• high 7.4 Chatway Live Chat

  Information disclosure

  CVE-2026-49082 · affected 1.4.8 and older · fixed in 1.4.9

• high 7.5 Appointment Booking Plugin

  Privilege escalation

  CVE-2026-49083 · affected 5.5.1 and older · fixed in 5.5.2

• high 7.5 Shared Files

  Path traversal / file read

  CVE-2026-49112 · affected 1.7.64 and older · fixed in 1.7.65

• high 7.5 Upsell Funnel Builder for WooCommerce

  Security issue

  CVE-2026-49110 · affected 3.1.4 and older · fixed in 3.1.5

• critical 9.3 Advanced 301 and 302 Redirect

  SQL injection

  CVE-2026-49067 · affected 1.6.9 and older · fixed in 1.7.0

• high 7.5 Conekta Payment Gateway

  Information disclosure

  CVE-2026-49066 · affected 6.0.0 and older · fixed in 6.0.1

• high 8.2 Hippoo Mobile App for WooCommerce

  Missing authorization check

  CVE-2026-49065 · affected 1.9.5 and older · fixed in 1.9.6

• high 7.5 Knit Pay

  Missing authorization check

  CVE-2026-49070 · affected 9.4.0.0 and older · fixed in 9.4.0.1

• high 7.3 Listdom

  Privilege escalation

  CVE-2026-49063 · affected 5.5.0 and older · fixed in 5.6.0

• high 7.5 Coupon Affiliates

  Information disclosure

  CVE-2026-49068 · affected 7.8.1 and older · fixed in 7.8.2

• high 7.5 WP Travel Engine

  Security issue

  CVE-2026-49078 · affected 6.7.10 and older · fixed in 6.7.11

• high 7.5 WPC Product Options for WooCommerce

  Path traversal / file read

  CVE-2026-49061 · affected 3.2.1 and older · fixed in 3.2.2

• high 8.8 Booking for Appointments and Events Calendar

  Privilege escalation

  CVE-2026-48889 · affected 2.3 and older · fixed in 2.4

• high 7.1 Drag and Drop Multiple File Upload for Contact…

  Cross-site scripting (XSS)

  CVE-2026-49055 · affected 1.3.9.7 and older · fixed in 1.3.9.8

• high 8.5 ELEX WordPress HelpDesk & Customer Ticketing S…

  SQL injection

  CVE-2026-48964 · affected 3.3.6 and older · fixed in 3.3.7

• high 7.1 FunnelKit

  Cross-site scripting (XSS)

  CVE-2026-48966 · affected 3.15.0.2 and older · fixed in 3.15.0.3

• high 7.5 WebToffee WooCommerce PDF Invoices, Packing Sl…

  Information disclosure

  CVE-2026-49056 · affected 4.9.4 and older · fixed in 4.9.5

• high 8.1 Really Simple Security

  Authentication bypass

  CVE-2026-48970 · affected 9.5.10 and older · fixed in 9.5.10.1

• medium 4.7 WP Migrate Lite

  Cross-site request forgery (CSRF)

  CVE-2026-49043 · affected 2.7.8 and older · fixed in 2.7.9

• medium 6.5 Backup, Restore and Migrate your sites with XC…

  Information disclosure

  CVE-2026-48965 · affected 4.8.6 and older · fixed in 4.8.7

• high 7.1 HollerBox

  Cross-site scripting (XSS)

  CVE-2026-48885 · affected 2.3.10.1 and older · fixed in 2.3.11

• medium 6.5 JS Help Desk

  Missing authorization check

  CVE-2026-48887 · affected 3.0.9 and older · fixed in 3.1.0

• critical 9.3 JS Help Desk

  SQL injection

  CVE-2026-48886 · affected 3.0.9 and older · fixed in 3.1.0

• high 7.1 Stop Spammers Classic

  Cross-site scripting (XSS)

  CVE-2026-48876 · affected 2026.3 and older · fixed in 2026.4

• critical 9.1 TrueBooker

  Missing authorization check

  CVE-2026-48881 · affected 1.1.9 and older · fixed in 1.2.0

• medium 6.5 Visual Link Preview

  Information disclosure

  CVE-2026-48878 · affected 2.4.1 and older · fixed in 2.4.2

• high 7.5 WPC Product Bundles for WooCommerce

  Missing authorization check

  CVE-2026-48883 · affected 8.5.3 and older · fixed in 8.5.4

• medium 6.5 WP Job Portal

  Cross-site scripting (XSS)

  CVE-2026-48880 · affected 2.5.2 and older · fixed in 2.5.3

• high 8.5 WP Time Slots Booking Form

  SQL injection

  CVE-2026-48882 · affected 1.2.50 and older · fixed in 1.2.51

• high 7.5 EmbedPress

  Information disclosure

  CVE-2026-48872 · affected 4.5.2 and older · fixed in 4.5.3

• high 8.5 GamiPress

  SQL injection

  CVE-2026-48874 · affected 7.8.7 and older · fixed in 7.8.8

• medium 6.5 King Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2026-48870 · affected 51.1.62 and older · fixed in 51.1.63

• high 7.5 Montonio for WooCommerce

  Missing authorization check

  CVE-2026-48873 · affected 10.1.2 and older · fixed in 10.1.3

• high 7.1 MW WP Form

  Cross-site scripting (XSS)

  CVE-2026-48871 · affected 5.1.3 and older · fixed in 5.1.4

• high 7.1 Post SMTP

  Cross-site scripting (XSS)

  CVE-2026-48838 · affected 3.6.2 and older · fixed in 3.6.3

• high 7.1 Quiz and Survey Master (QSM)

  Cross-site scripting (XSS)

  CVE-2026-48867 · affected 11.1.2 and older · fixed in 11.1.3

• high 7.5 Simple Shopping Cart

  Missing authorization check

  CVE-2026-48868 · affected 5.2.9 and older · fixed in 5.3.0

• critical 10.0 Easy Invoice

  Remote code execution

  CVE-2026-48836 · affected 2.1.19 and older · fixed in 2.1.20

• high 7.5 WPForms

  Missing authorization check

  CVE-2026-48835 · affected 1.10.0.4 and older · fixed in 1.10.0.5

• high 7.5 Event Booking Manager for WooCommerce

  Security issue

  CVE-2026-45441 · affected 5.3.3 and older · fixed in 5.3.4

• high 7.1 Product Filter Widget for Elementor

  Cross-site scripting (XSS)

  CVE-2026-45437 · affected 1.0.6 and older · fix not stated

• critical 9.3 Realtyna Organic IDX plugin + WPL Real Estate

  SQL injection

  CVE-2026-45439 · affected 5.1.0 and older · fixed in 5.2.0

• high 7.1 AutomatorWP

  Cross-site scripting (XSS)

  CVE-2026-42775 · affected 5.7.2 and older · fixed in 5.7.3

• medium 6.5 Masteriyo LMS

  Security issue

  CVE-2026-42743 · affected 2.1.8 and older · fixed in 2.1.9

• medium 6.5 Accept Stripe Payments

  Security issue

  CVE-2026-42752 · affected 2.0.98 and older · fixed in 2.0.99

• high 7.5 Online Scheduling and Appointment Booking System

  Information disclosure

  CVE-2026-42667 · affected 27.4 and older · fixed in 27.5

• high 8.1 EventPrime

  PHP object injection

  CVE-2026-42687 · affected 4.3.2.1 and older · fixed in 4.3.2.2

• high 7.1 EventPrime

  Cross-site scripting (XSS)

  CVE-2026-42686 · affected 4.3.2.1 and older · fixed in 4.3.2.2

• medium 6.5 Modula Image Gallery

  Cross-site scripting (XSS)

  CVE-2026-42688 · affected 2.14.23 and older · fixed in 2.14.24

• high 8.2 AI Product Search for WooCommerce

  Missing authorization check

  CVE-2026-42664 · affected 1.38.2 and older · fixed in 1.38.3

• high 7.5 Email Marketing for WooCommerce by Omnisend

  Authentication bypass

  CVE-2026-42668 · affected 1.18.0 and older · fixed in 1.18.1

• high 7.5 Salon Booking System

  Missing authorization check

  CVE-2026-42666 · affected 10.30.25 and older · fixed in 10.30.26

• medium 6.5 Simple Membership

  Cross-site scripting (XSS)

  CVE-2026-42663 · affected 4.7.2 and older · fixed in 4.7.3

• critical 9.3 WP Data Access

  SQL injection

  CVE-2026-42665 · affected 5.5.70 and older · fixed in 5.5.71

• medium 6.5 Advanced Form Integration

  Missing authorization check

  CVE-2026-42659 · affected 1.126.12 and older · fixed in 1.127.0

• high 7.1 Classified Listing

  Cross-site scripting (XSS)

  CVE-2026-42658 · affected 5.3.8 and older · fixed in 5.3.9

• medium 6.5 Contest Gallery

  Information disclosure

  CVE-2026-42660 · affected 28.1.7 and older · fixed in 29.0.0

• medium 5.3 Contest Gallery

  Security issue

  CVE-2026-42657 · affected 28.1.7 and older · fixed in 29.0.0

• medium 6.5 Contest Gallery

  Cross-site scripting (XSS)

  CVE-2026-42656 · affected 28.1.6 and older · fixed in 29.0.0

• high 8.8 WP Customer Area

  Path traversal / file read

  CVE-2026-42661 · affected 8.3.4 and older · fixed in 8.3.5

• medium 6.5 Event Tickets and Registration

  Security issue

  CVE-2026-42662 · affected 5.27.5 and older · fixed in 5.27.6.1

• medium 5.9 Paymattic

  Security issue

  CVE-2026-42655 · affected 4.6.19 and older · fixed in 4.6.20

• high 7.2 AutomatorWP

  Cross-site scripting (XSS)

  CVE-2026-42650 · affected 5.6.7 and older · fixed in 5.6.8

• medium 6.3 Classified Listing

  Missing authorization check

  CVE-2026-42651 · affected 5.3.9 and older · fixed in 5.3.10

• medium 6.5 Classified Listing

  Missing authorization check

  CVE-2026-42640 · affected 5.3.8 and older · fixed in 5.3.9

• high 8.1 CloudSecure WP Security

  Authentication bypass

  CVE-2026-42411 · affected 1.4.7 and older · fixed in 1.4.8

• high 7.1 Favicon Rotator

  Cross-site scripting (XSS)

  CVE-2026-42649 · affected 1.2.11 and older · fixed in 1.2.12

• critical 9.3 GD Rating System

  SQL injection

  CVE-2026-42639 · affected 3.6.2 and older · fixed in 3.7

• critical 9.3 Order Delivery Date for WooCommerce

  SQL injection

  CVE-2026-42386 · affected 4.5.1 and older · fixed in 4.5.2

• high 7.5 Simply Schedule Appointments

  Information disclosure

  CVE-2026-42384 · affected older than 1.6.11.2 · fixed in 1.6.11.2

• critical 9.3 FunnelKit

  SQL injection

  CVE-2026-42381 · affected 3.15.0.1 and older · fixed in 3.15.0.2

• medium 6.5 Stripe Payment Forms by WP Full Pay

  Authentication bypass

  CVE-2026-42378 · affected 8.4.1 and older · fixed in 8.4.2

• medium 6.5 ProfilePress

  Cross-site scripting (XSS)

  CVE-2026-41556 · affected 4.16.13 and older · fixed in 4.16.14

• medium 5.3 Simple CAPTCHA with Cloudflare Turnstile

  Authentication bypass

  CVE-2026-40799 · affected 1.38.0 and older · fixed in 1.38.1

• critical 9.3 wpForo Forum

  SQL injection

  CVE-2026-40798 · affected 3.0.4 and older · fixed in 3.0.5

• medium 6.5 WPPizza

  Information disclosure

  CVE-2026-40796 · affected 3.19.9 and older · fixed in 3.20

• medium 6.5 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2026-40795 · affected 2.2 and older · fixed in 2.2.1

• high 7.5 Booking for Appointments and Events Calendar

  Information disclosure

  CVE-2026-40789 · affected 2.2 and older · fixed in 2.2.1

• high 7.1 WPBot

  Missing authorization check

  CVE-2026-40788 · affected 7.9.7 and older · fixed in 7.9.9

• medium 6.5 Groundhogg

  Missing authorization check

  CVE-2026-40793 · affected older than 4.4.1 · fixed in 4.4.1

• medium 6.3 KiviCare

  Missing authorization check

  CVE-2026-40792 · affected 4.2.1 and older · fixed in 4.3.0

• medium 6.5 Points Management System For Gamification, Ran…

  Missing authorization check

  CVE-2026-40794 · affected 3.0.3 and older · fixed in 3.0.4

• medium 6.5 WSMS (formerly WP SMS)

  Information disclosure

  CVE-2026-40790 · affected 7.2.1 and older · fixed in 7.2.2

• high 7.1 WP Time Slots Booking Form

  Cross-site scripting (XSS)

  CVE-2026-40791 · affected 1.2.46 and older · fixed in 1.2.47

• high 7.1 AutomatorWP

  Authentication bypass

  CVE-2026-40785 · affected 5.6.7 and older · fixed in 5.6.8

• high 7.5 Booking Package

  Missing authorization check

  CVE-2026-40774 · affected 1.7.06 and older · fixed in 1.7.07

• high 7.7 Link Library

  Arbitrary file deletion

  CVE-2026-40779 · affected 7.8.8 and older · fixed in 7.8.9

• high 7.1 Quiz and Survey Master (QSM)

  Cross-site scripting (XSS)

  CVE-2026-40787 · affected 11.0.0 and older · fixed in 11.1.0

• high 7.5 ReviewX

  Authentication bypass

  CVE-2026-40781 · affected 2.3.6 and older · fixed in 2.3.7

• high 7.3 Royal MCP

  Missing authorization check

  CVE-2026-40775 · affected 1.4.2 and older · fixed in 1.4.3

• high 7.5 Eventin

  Missing authorization check

  CVE-2026-40776 · affected 4.1.8 and older · fixed in 4.1.9

• medium 6.5 WPAdverts

  Missing authorization check

  CVE-2026-40782 · affected 2.3.0 and older · fixed in 2.3.1

• medium 6.5 rtMedia for WordPress, BuddyPress and bbPress

  Missing authorization check

  CVE-2026-40773 · affected 4.7.9 and older · fixed in 4.7.10

• high 8.6 Contact Form Extender for Divi

  Arbitrary file deletion

  CVE-2026-40769 · affected 1.0.6 and older · fixed in 1.0.7

• critical 9.3 Contest Gallery

  SQL injection

  CVE-2026-40771 · affected 28.1.6 and older · fixed in 28.1.7

• critical 10.0 Geeky Bot

  Arbitrary file upload

  CVE-2026-40772 · affected 1.2.2 and older · fixed in 1.2.3

• high 8.5 MasterStudy LMS WordPress Plugin

  SQL injection

  CVE-2026-40766 · affected 3.7.25 and older · fixed in 3.7.26

• medium 6.5 Tutor LMS

  Missing authorization check

  CVE-2026-40743 · affected 3.9.7 and older · fixed in 3.9.8

• high 7.1 Coupon Affiliates

  Cross-site scripting (XSS)

  CVE-2026-40770 · affected 7.5.3 and older · fixed in 7.6.0

• high 7.5 WPGraphQL

  SQL injection

  CVE-2026-40762 · affected older than 2.11.1 · fixed in 2.11.1

• high 7.5 wpForo Forum

  Missing authorization check

  CVE-2026-40767 · affected older than 3.0.2 · fixed in 3.0.2

• high 7.7 Groundhogg

  Arbitrary file deletion

  CVE-2026-40727 · affected 4.4 and older · fixed in 4.4.1

• high 7.1 Notification for Telegram

  Cross-site scripting (XSS)

  CVE-2026-40732 · affected 3.5 and older · fixed in 3.5.1

• medium 6.4 Ultra Addons for WPForms

  Missing authorization check

  CVE-2026-39594 · affected 1.0.11 and older · fixed in 1.0.12

• high 7.5 Payment Gateway for Redsys & WooCommerce Lite

  Missing authorization check

  CVE-2026-40741 · affected 7.0.0 and older · fixed in 7.0.1

• critical 9.9 WP-BusinessDirectory

  Arbitrary file upload

  CVE-2026-39591 · affected 4.0.0 and older · fixed in 4.0.1

• high 7.5 AWP Classifieds

  Missing authorization check

  CVE-2026-39533 · affected 4.4.4 and older · fixed in 4.4.5

• high 8.8 bBlocks

  Privilege escalation

  CVE-2026-39579 · affected 2.0.31 and older · fixed in 2.0.32

• medium 6.5 RepairBuddy

  Missing authorization check

  CVE-2026-39584 · affected 4.1132 and older · fixed in 4.1133

• critical 9.8 Datalogics Ecommerce Delivery

  Privilege escalation

  CVE-2026-39583 · affected 2.6.62 and older · fixed in 2.6.63

• high 8.8 Events Calendar for GeoDirectory

  PHP object injection

  CVE-2026-39532 · affected 2.3.25 and older · fixed in 2.3.26

• medium 6.5 Shipment Tracker for Woocommerce

  Cross-site scripting (XSS)

  CVE-2026-39540 · affected 1.5.3.2 and older · fixed in 1.5.3.3

• high 8.1 WP BASE Booking of Appointments, Services and…

  Privilege escalation

  CVE-2026-39587 · affected 5.9.0 and older · fixed in 6.0.0

• high 7.5 WP Directory Kit

  Missing authorization check

  CVE-2026-39534 · affected 1.5.0 and older · fixed in 1.5.1

• medium 6.5 Booking Activities

  Missing authorization check

  CVE-2026-39525 · affected 1.16.48.1 and older · fixed in 1.17.0

• high 7.1 EventPrime

  Missing authorization check

  CVE-2026-39518 · affected 4.3.0.0 and older · fixed in 4.3.0.1

• critical 9.3 Geeky Bot

  SQL injection

  CVE-2026-39519 · affected 1.2.0 and older · fixed in 1.2.1

• high 7.5 Masteriyo LMS

  Missing authorization check

  CVE-2026-39524 · affected 2.1.5 and older · fixed in 2.1.6

• medium 6.5 Motors

  Missing authorization check

  CVE-2026-39515 · affected older than 1.4.107 · fixed in 1.4.107

• high 7.1 Paid Membership Subscriptions

  Cross-site scripting (XSS)

  CVE-2026-39514 · affected 2.17.3 and older · fixed in 3.0.0

• critical 9.3 SpeakOut! Email Petitions

  SQL injection

  CVE-2026-39530 · affected 4.6.5 and older · fixed in 4.6.5.1

• medium 5.4 WpStream

  Arbitrary file upload

  CVE-2026-39527 · affected older than 4.11.2 · fixed in 4.11.2

• high 7.2 Advanced Product Fields (Product Addons) for W…

  PHP object injection

  CVE-2026-39499 · affected 1.6.19 and older · fixed in 1.6.20

• high 7.5 Easy Appointments

  Missing authorization check

  CVE-2026-39513 · affected 3.12.21 and older · fixed in 3.12.22

• high 7.5 Easy Digital Downloads

  Missing authorization check

  CVE-2026-39503 · affected 3.6.5 and older · fixed in 3.6.6

• critical 9.3 Form Maker by 10Web

  SQL injection

  CVE-2026-39502 · affected 1.15.38 and older · fixed in 1.15.39

• critical 9.3 GeoDirectory

  SQL injection

  CVE-2026-39512 · affected 2.8.152 and older · fixed in 2.8.154

• high 7.1 Social Slider Feed

  Cross-site scripting (XSS)

  CVE-2026-39507 · affected 2.3.2 and older · fixed in 2.3.3

• critical 9.3 WP Photo Album Plus

  SQL injection

  CVE-2026-39511 · affected 9.1.08.001 and older · fixed in 9.1.08.002

• high 7.2 YayMail

  PHP object injection

  CVE-2026-39498 · affected 4.3.3 and older · fixed in 4.3.4

• high 7.5 Backup Migration

  Information disclosure

  CVE-2026-39480 · affected 2.1.1 and older · fixed in 2.1.2

• medium 4.4 Download Monitor

  Path traversal / file read

  CVE-2026-39489 · affected 5.1.9 and older · fixed in 5.1.10

• high 8.8 Anti-Malware Security and Brute-Force Firewall

  PHP object injection

  CVE-2026-39478 · affected 4.23.87 and older · fixed in 4.23.88

• medium 6.5 Jupiter X Core

  Cross-site scripting (XSS)

  CVE-2026-39491 · affected 4.14.1 and older · fixed in 4.14.2

• high 7.2 Modula Image Gallery

  PHP object injection

  CVE-2026-39481 · affected 2.14.18 and older · fixed in 2.14.19

• high 8.8 Post Duplicator

  PHP object injection

  CVE-2026-39474 · affected 3.0.10 and older · fixed in 3.0.11

• critical 9.3 Simply Schedule Appointments

  SQL injection

  CVE-2026-39493 · affected 1.6.9.27 and older · fixed in 1.6.9.29

• critical 9.3 WP Maps

  SQL injection

  CVE-2026-39492 · affected 4.9.1 and older · fixed in 4.9.2

• high 7.1 Contact Form to Any API

  Cross-site scripting (XSS)

  CVE-2026-39449 · affected 3.0.3 and older · fixed in 3.0.4 *

• medium 6.8 Meta Box

  Arbitrary file deletion

  CVE-2026-39468 · affected 5.11.1 and older · fixed in 5.11.2

• critical 9.1 Slider, Gallery, and Carousel by MetaSlider

  Remote code execution

  CVE-2026-39465 · affected 3.106.0 and older · fixed in 3.107.0

• high 7.2 ShortPixel Image Optimizer

  PHP object injection

  CVE-2026-39471 · affected 6.4.3 and older · fixed in 6.4.4

• high 7.2 Cart Abandonment Recovery for WooCommerce

  Privilege escalation

  CVE-2026-39470 · affected older than 2.1.0 · fixed in 2.1.0

• high 7.2 PDF Invoices & Packing Slips for WooCommerce

  PHP object injection

  CVE-2026-39472 · affected older than 5.9.0 · fixed in 5.9.0

• high 7.1 ManageWP Worker

  Cross-site scripting (XSS)

  CVE-2026-39463 · affected 4.9.31 and older · fixed in 4.9.32

• medium 6.3 WP Google Review Slider

  Cross-site scripting (XSS)

  CVE-2026-39451 · affected 18.0 and older · fixed in 18.1

• high 7.1 FunnelKit Automations

  Authentication bypass

  CVE-2026-39450 · affected 3.7.3 and older · fixed in 3.8.0

• high 7.1 cformsII

  Cross-site scripting (XSS)

  CVE-2026-39435 · affected 15.1.3 and older · fixed in 15.1.4

• critical 9.3 Feed KuantoKusta for WooCommerce

  SQL injection

  CVE-2026-39441 · affected 5.3 and older · fixed in 5.3.1

• high 7.1 GiveWP

  Cross-site scripting (XSS)

  CVE-2026-34900 · affected 4.14.2 and older · fixed in 4.14.3

• high 7.1 Simply Schedule Appointments

  Cross-site scripting (XSS)

  CVE-2026-39447 · affected 1.6.10.6 and older · fixed in 1.6.11.0

• high 7.1 Product Table & List Builder for WooCommerce

  Cross-site scripting (XSS)

  CVE-2026-34902 · affected 4.6.3 and older · fixed in 4.6.4

• high 7.2 Product Feed Manager for WooCommerce

  PHP object injection

  CVE-2026-39434 · affected 6.6.26 and older · fixed in 6.6.27

• critical 9.8 iControlWP

  Privilege escalation

  CVE-2026-34901 · affected 5.5.3 and older · fixed in 5.5.4

• high 7.2 AI Engine

  Privilege escalation

  CVE-2026-27407 · affected 3.4.9 and older · fixed in 3.5.0

• high 7.5 Event Tickets Manager for WooCommerce

  Missing authorization check

  CVE-2026-34898 · affected 1.5.3 and older · fixed in 1.5.4

• medium 6.5 Rank Math SEO

  Missing authorization check

  CVE-2026-34892 · affected 1.0.271 and older · fixed in 1.0.271.1

• high 7.5 Simple Membership

  Missing authorization check

  CVE-2026-34886 · affected 4.7.1 and older · fixed in 4.7.2

• high 7.5 IDPay Payment Gateway for Woocommerce

  Information disclosure

  CVE-2026-34891 · affected 2.2.5 and older · fix not stated

• medium 5.3 Essential Addons for Elementor

  Missing authorization check

  CVE-2026-25440 · affected older than 6.6.0 · fixed in 6.6.0

• high 8.5 PowerPress Podcasting plugin by Blubrry

  SQL injection

  CVE-2026-24637 · affected 11.15.10 and older · fixed in 11.15.11

• high 8.1 Paid Videochat Turnkey Site

  PHP object injection

  CVE-2026-27333 · affected 7.3.23 and older · fixed in 7.3.24

• high 7.5 Travelly

  Security issue

  CVE-2026-27089 · affected 2.1.7 and older · fixed in 2.1.8

• high 7.5 User Registration & Membership

  Missing authorization check

  CVE-2026-25425 · affected 5.1.2 and older · fixed in 5.1.3

• critical 9.8 Broadcast Live Video

  PHP object injection

  CVE-2026-27053 · affected older than 7.1.3 · fixed in 7.1.3

• high 7.1 Redirection for Contact Form 7

  Cross-site scripting (XSS)

  CVE-2026-23970 · affected 3.2.8 and older · fixed in 3.2.9

• medium 6.5 Bookify

  Missing authorization check

  CVE-2025-69332 · affected 1.1.1 and older · fixed in 1.1.2

• medium 6.3 bunny.net

  Missing authorization check

  CVE-2025-68049 · affected 2.3.6 and older · fixed in 2.3.7

• high 7.1 affects latest 1.1.2 iRobots.txt SEO

  Cross-site scripting (XSS)

  CVE-2025-68840 · affected 1.1.2 and older · no fix listed yet

• high 7.1 Okay Toolkit

  Cross-site scripting (XSS)

  CVE-2025-68851 · affected 2.3 and older · fix not stated

• medium 4.4 PopAd

  Server-side request forgery (SSRF)

  CVE-2025-60175 · affected 1.0.4 and older · fix not stated

• high 7.1 Eli's WordCents adSense Widget with Analytics

  Cross-site scripting (XSS)

  CVE-2025-68872 · affected 1.3.03.27 and older · fix not stated

• high 7.5 Projectopia

  Missing authorization check

  CVE-2025-59133 · affected 5.1.25.2 and older · fixed in 5.1.26 *

• medium 6.5 affects latest v1.0.2 Elizaibots

  Cross-site scripting (XSS)

  CVE-2025-15659 · affected 1.0.2 and older · no fix listed yet

• medium 5.9 affects latest 0.3.4 WP Emmet

  Cross-site scripting (XSS)

  CVE-2025-15658 · affected 0.3.4 and older · no fix listed yet

• critical 10.0 PDF Builder for WooCommerce. Create invoices,p…

  Remote code execution

  CVE-2026-52704 · affected 2.0.8 and older · fixed in 2.0.9

• high 8.8 Faust.js

  Authentication bypass

  CVE-2026-49062 · affected 1.8.7 and older · fixed in 1.8.8

• high 7.5 Payment forms, Buy now buttons, and Invoicing…

  Information disclosure

  CVE-2026-49064 · affected 2.8.49 and older · fixed in 2.8.50

• high 8.8 Masteriyo LMS

  Privilege escalation

  CVE-2026-49111 · affected 2.2.0 and older · fixed in 2.2.1

• medium 6.5 Really Simple Security

  Missing authorization check

  CVE-2026-48969 · affected 9.5.9 and older · fixed in 9.5.10

• medium 5.3 WP Go Maps

  Security issue

  CVE-2026-8386 · affected older than 10.0.10 · fixed in 10.0.10

• medium 5.3 WP Go Maps

  Information disclosure

  CVE-2026-8385 · affected older than 10.0.10 · fixed in 10.0.10

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan