WordPress plugin vulnerabilities: week 26, 2026
202 vulnerabilities published Jun 22 – Jun 28, 2026 in 177 plugins we track, by day.
17 critical 86 high 98 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, June 28, 2026 · 1
Saturday, June 27, 2026 · 19
-
medium 5.3 RegistrationMagic
-
medium 4.3 Quiz and Survey Master (QSM)
-
medium 4.3 Dokan
-
medium 6.4 Dokan
-
medium 4.4 Gutenverse
-
medium 4.3 Masteriyo LMS
-
medium 6.5 Frisbii Pay
-
medium 6.4 Page Builder by SiteOrigin
-
medium 5.3 Stripe Payment Forms by WP Full Pay
-
medium 4.3 Product Specifications for Woocommerce
-
medium 6.4 Surbma
-
medium 6.1 MaxButtons
-
medium 5.3 NEX-Forms
-
critical 9.8 Invoice Generator
-
medium 6.4 CodePeople Post Map for Google Maps
-
medium 4.3 HD Quiz
-
medium 4.4 Ivory Search
-
medium 6.5 Groundhogg
-
medium 6.5 Groundhogg
Friday, June 26, 2026 · 99
-
medium 5.3 Booking and Rental Manager for Bike
-
medium 4.3 Bopo
-
high 8.5 Contest Gallery
-
high 8.5 Groundhogg
-
medium 5.4 WPComplete
-
medium 6.5 Affiliates Manager
-
high 8.2 Child Theme Wizard
-
medium 6.5 Block Animations, Motion & Scroll Effects
-
medium 4.3 Gmail SMTP
-
medium 5.9 Hester Core
-
medium 5.3 JS Help Desk
-
critical 9.1 TemplateSpare
-
high 8.5 WP Job Portal
-
medium 4.3 Shoppable Images (Lookbook) for WooCommerce
-
medium 6.5 Magazine Blocks
-
medium 5.4 Majestic Support
-
high 8.5 Restaurant Menu and Food Ordering
-
medium 4.3 Nelio Content
-
high 8.1 Newsletters
-
high 7.5 Panorama
-
medium 6.5 Fluent Booking
-
high 8.5 Gallery by BestWebSoft
-
medium 4.3 MasterStudy LMS WordPress Plugin
-
medium 4.3 Abandoned Cart Lite for WooCommerce
-
high 8.5 WP Post Author
-
high 8.5 wpForo Forum
-
high 7.6 Popup Box
-
medium 4.9 Kirki
-
medium 6.5 StatCounter
-
medium 5.4 Email Marketing for WooCommerce by Omnisend
-
medium 4.3 PPWP
-
medium 5.3 WCBoost
-
high 7.6 WP All Import
-
medium 6.5 Featured Image
-
medium 6.5 GIFT4U
-
medium 4.3 WPCafe
-
medium 6.5 GetGenie
-
high 7.1 Interactive Content
-
medium 5.8 HTML5 Video Player
-
high 7.1 Simply Schedule Appointments
-
medium 6.5 Site Reviews
-
high 7.1 SureCart
-
high 7.1 weMail
-
high 7.1 FOX
-
high 7.1 Everest Forms
-
medium 6.5 SureCart
-
critical 9.3 Advance Product Search- Voice & Ajax Search fo…
-
high 8.3 Block for Mailchimp
-
critical 9.3 Quotes llama
-
medium 5.8 ShortPixel Adaptive Images
-
high 7.5 Subscriptions for WooCommerce
-
high 8.5 Tourfic
-
high 7.1 Blog2Social
-
high 7.1 Customer Reviews for WooCommerce
-
high 7.1 Responsive Lightbox & Gallery
-
high 8.6 BitFire Security
Security issue
-
high 7.1 Gutenverse Form
-
critical 9.3 Library Management System
-
critical 9.3 워드프레스 결제 심플페이
-
high 7.1 Quick Interest Slider
-
high 8.8 Frisbii Pay
-
high 8.1 Uncanny Automator
-
critical 9.8 Easy Elements for Elementor
-
high 7.1 MapPress
-
high 7.5 Paymob for WooCommerce
-
critical 9.8 Paytium
-
medium 6.4 utm.codes
-
critical 9.9 Booster for WooCommerce
-
high 7.5 Intranet & Private Site
-
high 7.3 Newsletters
-
high 7.5 Stylish Cost Calculator
-
high 7.5 Trinity Backup
-
high 7.4 Enable CORS
Security issue
-
critical 9.3 GeoDirectory
-
high 7.5 Gutenverse Companion
-
high 7.5 Object Cache 4 everyone
-
high 7.5 Quads Ads Manager for Google AdSense
-
high 7.6 SupportCandy
-
critical 9.3 wpDataTables
-
medium 6.5 User Registration & Membership
-
medium 5.3 SiteGround Email Marketing
-
medium 6.5 BNE Testimonials
-
medium 6.5 Image Carousel
-
medium 5.3 Donation Thermometer
-
medium 4.3 Live Copy Paste for Elementor
-
medium 4.3 Restaurant Menu and Food Ordering
-
medium 5.4 affects latest 2.1.3 Forget About Shortcode Buttons
-
medium 6.5 Exclusive Addons for Elementor
-
medium 6.5 User Registration & Membership
-
medium 6.5 Frontend File Manager Plugin
-
high 7.5 YMC Filter
Security issue
-
medium 6.5 Groundhogg
Thursday, June 25, 2026 · 33
-
medium 6.5 Elementor Website Builder
-
medium 6.5 Slim SEO
-
high 8.8 EventPrime
-
high 7.1 Forminator Forms
-
high 7.7 JS Help Desk
-
high 7.1 TablePress
-
high 7.1 Interactive Content
-
medium 6.5 License Manager for WooCommerce
-
high 7.1 affects latest 3.11.5 Master Slider
-
high 8.5 Post Snippets
-
medium 5.4 UPI QR Code Payment Gateway for WooCommerce
-
medium 6.5 PPOM
-
critical 9.3 Premmerce Wishlist for WooCommerce
-
high 8.3 WC Shop Sync
-
high 7.1 WP Activity Log
-
high 7.5 CheckView
-
high 8.1 Royal MCP
-
high 7.5 Vitepos
-
high 8.1 MDTF
-
critical 9.3 MDTF
-
high 7.5 Five Star Restaurant Reservations
-
high 8.5 WC Vendors
-
high 7.5 WP Photo Album Plus
-
critical 9.3 YMC Filter
-
high 7.5 Motors
-
high 8.5 Manago AI & Leadoo AI
-
high 7.4 Visual Link Preview
-
critical 9.9 Widget Options
-
high 7.5 MainWP Child
-
high 7.5 Tourfic
-
medium 6.5 Masteriyo LMS
Security issue
-
medium 6.4 Gutenberg Essential Blocks
Wednesday, June 24, 2026 · 44
-
high 8.8 AdRotate Banner Manager
-
high 7.6 FunnelKit
-
high 8.8 Ultimate Member
-
medium 4.3 Book a Room Event Calendar
-
high 7.7 Cornerstone
Security issue
-
high 7.7 Cornerstone
Security issue
-
medium 4.3 MotorDesk
-
high 7.2 WP Meta SEO
-
medium 4.3 24liveblog
-
medium 4.3 24liveblog
-
medium 5.3 Devs Accounting
-
medium 4.3 Generate Security.txt
-
medium 4.3 Reviews and Rating
-
medium 5.3 WhatsOrder
-
high 7.5 WP Forms Connector
-
high 7.5 WP Forms Connector
-
medium 6.4 WP Latest Posts
-
medium 4.3 Advance Nav Menu Manager
-
medium 6.4 Avalon23 Products Filter for WooCommerce
-
high 7.5 ClearSale Total
-
medium 5.3 Devs Accounting
-
medium 6.1 EntreDroppers
-
medium 6.4 MIR blocks and shortcodes
-
medium 6.1 Osiris Signature Banner
-
medium 5.3 RentMy Real-Time Rental Management Plugin
-
medium 4.3 Assistio
-
medium 6.1 Image Sizes on Demand
-
medium 4.3 MP Customize Login Page
-
high 8.8 Welcome Software Publishing
-
medium 5.3 SearchPlus
-
medium 5.3 Secufor OAuth
-
medium 5.3 Advanced Contact Form 7
-
medium 4.3 Bulk SEO Image
-
low 2.7 Site Kit by Google
Security issue
-
critical 9.8 Invoice Generator
-
high 7.2 Kargo Takip
-
high 7.2 URL Preview
-
critical 9.8 SignUp & SignIn
-
medium 6.4 WP Meta SEO
-
medium 4.3 Blue Captcha
-
high 7.2 Email JavaScript Cloak
-
high 7.2 Post Duplicator
Security issue
-
high 7.2 Cincopa video and media plug-in
-
medium 6.4 Xpro Addons
Tuesday, June 23, 2026 · 5
-
medium 6.4 ProfileGrid
-
high 7.5 Frontend File Manager Plugin
Security issue
-
medium 5.4 Frontend File Manager Plugin
-
high 8.8 Infility Global
-
medium 6.8 Infility Global
Monday, June 22, 2026 · 1
-
medium 5.3 Pie Register
Security issue
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.